Delete Spam Daily Security & Risk Analysis

The 'delete-spam-daily' plugin v1.0.2 exhibits a mixed security posture. On the positive side, the static analysis reveals a very small attack surface, with no identified AJAX handlers, REST API routes, or shortcodes. Furthermore, there are no known vulnerabilities (CVEs) associated with this plugin, which is a strong indicator of past security diligence. However, significant concerns arise from the code analysis. All SQL queries are performed without prepared statements, presenting a substantial risk of SQL injection vulnerabilities. Additionally, none of the identified output operations are properly escaped, which could lead to cross-site scripting (XSS) flaws. While a nonce check is present, there are no capability checks on the cron event, meaning any authenticated user could potentially trigger this function.