Current Location Security & Risk Analysis

The 'current-location' v1.5.9 plugin exhibits a mixed security posture, with some good practices but also notable concerns. The plugin has a very small attack surface, with only one shortcode and no identified AJAX, REST API, or cron entry points that are unprotected. The absence of known vulnerabilities in its history is a positive sign, suggesting a generally well-maintained codebase. However, the static analysis reveals critical weaknesses. The use of the `create_function` is a significant security risk due to its potential for code injection. Furthermore, a very low percentage of output is properly escaped (3%), indicating a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. While SQL queries are prepared, the overall lack of robust output sanitization presents a substantial risk that could be exploited by attackers, potentially leading to arbitrary code execution or data leakage through crafted inputs.