Easy Admin Notification Security & Risk Analysis

The "easy-admin-notification" plugin v1.4 presents a mixed security posture. On one hand, the static analysis reveals a remarkably small attack surface with no identified AJAX handlers, REST API routes, shortcodes, or cron events. This indicates a good effort to limit potential entry points into the plugin's functionality. Furthermore, the absence of known CVEs and a clean vulnerability history suggests the plugin has historically been well-maintained or has not attracted significant security scrutiny. However, the code analysis raises several significant concerns. The presence of a SQL query that is not using prepared statements is a major red flag, potentially exposing the application to SQL injection vulnerabilities. Additionally, the complete lack of output escaping for all identified output points is highly concerning, suggesting a broad susceptibility to cross-site scripting (XSS) attacks. The plugin also lacks nonce checks, which are crucial for preventing cross-site request forgery (CSRF) attacks on any unauthenticated entry points (though none were identified here).