WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments Security & Risk Analysis

The 'delete-all-comments-of-website' plugin version 6.8 exhibits a generally strong security posture. All identified AJAX and REST API entry points appear to have authentication and permission checks, which is a significant strength. The absence of known CVEs, common vulnerability types, and any recorded vulnerabilities suggests a history of responsible development and patching, or a lack of targeted attacks. However, the code analysis reveals some areas for improvement. A notable concern is the proportion of SQL queries (24%) not using prepared statements, which could be susceptible to SQL injection if user input is not meticulously handled. Additionally, while most output is escaped, 28% of outputs are not properly escaped, potentially leading to cross-site scripting (XSS) vulnerabilities. The presence of unsanitized paths in taint analysis, though not critical, warrants attention as it can be an indicator of potential path traversal or file system vulnerabilities.