Head.WP Security & Risk Analysis

The "headwp" plugin v2.0.3 exhibits a mixed security posture. On the positive side, it has a very small attack surface with only two shortcodes and no AJAX handlers or REST API routes. Crucially, none of these entry points are reported as unprotected. The plugin also has no known historical CVEs, indicating a generally stable security track record. However, significant concerns arise from the code analysis. The plugin uses raw SQL queries without prepared statements, which is a substantial risk for SQL injection vulnerabilities. Furthermore, none of the 13 identified output operations are properly escaped, leaving it highly susceptible to Cross-Site Scripting (XSS) attacks. The absence of nonce and capability checks on all entry points is also a critical oversight, further widening the potential for exploits.