Bot Block – Stop Spam Referrals in Google Analytics Security & Risk Analysis

This plugin exhibits several concerning security practices. While the attack surface appears minimal with no direct entry points exposed to users, the static analysis reveals a significant lack of fundamental security measures. All SQL queries are executed without prepared statements, a major vulnerability that can lead to SQL injection. Furthermore, no output is properly escaped, creating a high risk of Cross-Site Scripting (XSS) attacks. The absence of nonce and capability checks on any potential entry points (though none are explicitly identified) is also a weakness. The vulnerability history confirms these concerns, showing a past medium-severity XSS vulnerability, which aligns with the unescaped output issue. While the plugin is updated, the persistent nature of these flaws and the historical XSS suggest a need for immediate remediation.