bbP topic count Security & Risk Analysis

The bbp-topic-count plugin v3.2 presents a mixed security posture. While it demonstrates good practices in certain areas, such as a complete lack of file operations and external HTTP requests, and a high percentage of properly escaped outputs, significant concerns remain. The static analysis revealed two SQL queries that are not using prepared statements, which is a notable risk for potential SQL injection vulnerabilities. Furthermore, the complete absence of nonce checks and capability checks on any entry points is a major weakness, as it leaves the plugin susceptible to various attacks if any of its shortcodes could be triggered maliciously. The plugin also has a history of a medium severity vulnerability related to Cross-site Scripting, and concerningly, there is one currently unpatched medium severity CVE. This history suggests a tendency towards input sanitization and authorization issues.