HumanCaptcha by Outerbridge Security & Risk Analysis

The humancaptcha plugin v4.1.1 presents a concerning security posture despite a seemingly clean vulnerability history and a limited attack surface. While there are no recorded CVEs and the static analysis shows no directly dangerous functions or external HTTP requests, several code signals raise red flags. The fact that 44% of SQL queries are not using prepared statements is a significant risk, potentially leading to SQL injection vulnerabilities. Furthermore, a high percentage (69%) of output is not properly escaped, which could open the door to cross-site scripting (XSS) attacks. The single taint flow with an unsanitized path, though not flagged as critical or high severity, still represents an area where malicious input could be processed improperly.