Inactive User Deleter Security & Risk Analysis

The "inactive-user-deleter" plugin v1.65 exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for most SQL queries and includes nonce and capability checks, significant concerns arise from its attack surface and output handling. The presence of one AJAX handler without authentication checks is a direct gateway for potential attacks. Furthermore, a low percentage of properly escaped output (8%) suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the user interface. The plugin also uses the `unserialize` function, which can be a vector for remote code execution if it processes untrusted data. Historically, the plugin has one high-severity vulnerability, which, though currently patched, highlights a past susceptibility to significant security flaws, specifically CSRF. This history, combined with the current lack of output escaping and the unprotected AJAX endpoint, paints a picture of a plugin that requires careful attention to mitigate potential risks.