Faculty and Staff Directory Security & Risk Analysis

The faculty-and-staff-directory plugin version 1.51 presents a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and including a nonce check. Its vulnerability history is clean, with no recorded CVEs, suggesting a potentially well-maintained codebase or a lack of past security scrutiny. However, several concerns arise from the static analysis. The presence of `create_function`, a deprecated and often insecure PHP function, is a significant red flag. Furthermore, a very low percentage of output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities, especially considering the plugin has at least one shortcode which can be an entry point for user-supplied data to reach output functions. The absence of capability checks on its single entry point (shortcode) also means any authenticated user could potentially leverage its functionality, even if they are not intended to.