BuddyPress Follow Security & Risk Analysis

The Buddypress-Followers v1.2.2 plugin exhibits a generally good security posture with several strong practices in place. Notably, all SQL queries are performed using prepared statements, and there are no known CVEs associated with this plugin, indicating a history of responsible development and maintenance. The attack surface is relatively small and appears to be protected by nonce checks where necessary, further enhancing its security.

However, there are a few areas of concern. The presence of the `create_function` is a significant security risk, as this function is deprecated and can lead to serious vulnerabilities if used with user-supplied input. Furthermore, only 33% of output escaping is properly handled, suggesting a potential for cross-site scripting (XSS) vulnerabilities in the remaining two-thirds of outputs. The lack of capability checks on the AJAX handlers, despite nonce checks being present, could still allow unauthenticated users to trigger certain actions if the AJAX endpoints are not adequately protected by WordPress's user role management.

In conclusion, while the plugin has a clean vulnerability history and utilizes secure database practices, the use of `create_function` and the suboptimal output escaping represent notable weaknesses that require immediate attention. Addressing these specific code-level issues would significantly improve the plugin's overall security.