Click to Chat Security & Risk Analysis

The dragwyb-click-to-chat plugin v1.0.6 exhibits a generally strong security posture based on the provided static analysis. A significant majority of its output is properly escaped, and it appears to implement adequate nonce and capability checks on its entry points, including AJAX handlers. The absence of critical or high-severity taint flows, dangerous functions, file operations, and known vulnerabilities is highly encouraging.

However, a notable concern arises from the single SQL query identified, which is not using prepared statements. While the plugin has a small attack surface and no known vulnerabilities, this raw SQL query represents a potential injection point if the input leading to it is not rigorously sanitized. The presence of an external HTTP request also warrants attention, as it could be a vector for further attacks or data leakage if not handled securely. Overall, the plugin demonstrates good development practices with proper escaping and authentication, but the un-prepared SQL query is a weakness that should be addressed.