CT Contact Security & Risk Analysis

The "ct-contact" plugin v1.0.0 exhibits a generally good security posture with no known vulnerabilities in its history and all SQL queries utilizing prepared statements. However, the static analysis reveals a significant concern: the use of the deprecated and insecure `create_function` function. This function is a known source of potential vulnerabilities if used with unsanitized input, as it essentially allows for the execution of arbitrary PHP code. Furthermore, a very low percentage of output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities where user-supplied data could be injected into the page's output without proper sanitization.