Floating Awesome Button (Sticky Button, Popup, Toast) & 200+ Website Custom Interactive Element Security & Risk Analysis

The "floating-awesome-button" v2.21.0 plugin exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices with a high percentage of properly escaped outputs and a substantial number of nonce and capability checks. Its vulnerability history is also clean, with no recorded CVEs, suggesting a generally well-maintained codebase.

However, there are significant areas of concern. The presence of three AJAX handlers without authentication checks exposes a direct attack vector. While taint analysis shows no immediate flows, the use of the `unserialize` function is a critical code signal that can lead to remote code execution if not handled with extreme care and proper sanitization of the serialized data source. Additionally, 60% of its SQL queries are not using prepared statements, which can be a vulnerability for SQL injection if user input is directly incorporated.

In conclusion, while the lack of past vulnerabilities and good output escaping are strengths, the unprotected AJAX endpoints and the use of `unserialize` coupled with raw SQL queries represent notable risks that require immediate attention and remediation.