Classic Editor Plus – WordPress Classic Editor plugin by Felix Security & Risk Analysis

The "classic-editor-plus" plugin v1.1.5 exhibits a strong security posture based on the provided static analysis. The plugin has no identified CVEs, indicating a history of responsible development or a lack of public vulnerability disclosures. The code analysis reveals a commendably small attack surface, with no exposed AJAX handlers, REST API routes, shortcodes, or cron events that lack authentication or proper permission checks. Furthermore, the plugin demonstrates good practices by avoiding dangerous functions, file operations, and external HTTP requests, and all identified SQL queries utilize prepared statements. The presence of nonce and capability checks further enhances its security. However, while the vast majority of outputs are properly escaped, a small percentage not being so could potentially present a minor risk in specific, yet unarticulated, scenarios. Overall, this plugin appears to be developed with security in mind, prioritizing robust input validation and output sanitization where applicable.