Author Tag Cloud Security & Risk Analysis

The "authors-tag-cloud" v1.0 plugin exhibits a concerning security posture despite having no known past vulnerabilities. The static analysis reveals significant red flags. The presence of the `create_function` dangerous function, which is deprecated and can lead to code injection vulnerabilities if not handled with extreme care and sanitization, is a major concern. Furthermore, the plugin executes SQL queries without utilizing prepared statements, making it susceptible to SQL injection attacks. The lack of any capability checks or nonce checks on potential entry points, although there are currently no identified entry points, indicates a potential for future vulnerabilities if new features are added without proper security considerations. While the plugin boasts a small attack surface and no recorded CVEs, these strengths are overshadowed by the critical weaknesses identified in the code itself.