Exchange Rate Table Security & Risk Analysis

The 'exchange-rate-table' plugin, version 1.4, exhibits a concerning security posture despite a clean vulnerability history. The static analysis reveals several critical weaknesses, most notably the presence of the 'unserialize' function without any apparent authorization or capability checks. This function is notorious for leading to Remote Code Execution (RCE) vulnerabilities if an attacker can control the serialized data. Furthermore, a complete lack of output escaping across all identified outputs is a significant concern. This means any data displayed by the plugin could be vulnerable to Cross-Site Scripting (XSS) attacks, allowing attackers to inject malicious scripts into user browsers. The absence of any recorded CVEs is positive, but it does not negate the inherent risks identified in the code itself. The plugin’s static analysis indicates a potentially large attack surface due to unprotected entry points. While the SQL queries are prepared, the other identified issues present substantial security risks.