Exclusive Hover effects Security & Risk Analysis

The "exclusive-hover-effects" plugin v2.2.1 exhibits a mixed security posture. While it has no recorded vulnerability history, which is a positive indicator, the static analysis reveals several concerning practices. The presence of an unprotected AJAX handler significantly expands the attack surface, making it a primary concern. The taint analysis highlighting two flows with unsanitized paths, even without critical or high severity designations, suggests potential for vulnerabilities if these paths are triggered. Furthermore, the plugin uses the dangerous `create_function` and has a concerningly low percentage of properly escaped output, indicating a higher risk of cross-site scripting (XSS) vulnerabilities. The use of raw SQL queries without prepared statements is also a red flag for potential SQL injection risks. Despite the lack of known CVEs, these code-level issues point to potential weaknesses that could be exploited. The plugin demonstrates some good practices like nonce and capability checks, but these are overshadowed by the critical areas of concern regarding unprotected entry points and insecure coding practices.