Extended CRM for Users Insights Security & Risk Analysis

The "extended-crm-for-users-insights" v1.2.1 plugin presents a concerning security posture due to significant unprotected entry points. While the static analysis shows no critical or high-severity code signals like dangerous functions, SQL injection risks are high due to 100% of SQL queries not using prepared statements. The plugin also exhibits a low rate of proper output escaping, with only 33% of outputs being safe. The presence of two AJAX handlers without authentication checks is a major concern, creating a broad attack surface that could be exploited by unauthenticated users. The absence of any recorded vulnerabilities in its history might suggest a lack of active targeting or prior patching, but it does not negate the immediate risks identified in the code. Overall, the plugin has a weak security foundation due to unprotected AJAX endpoints and insecure SQL practices, despite a clean vulnerability history.