Justified Gallery Security & Risk Analysis

The 'justified-gallery' v1.10.0 plugin exhibits a mixed security posture. On the positive side, the static analysis reveals a very small attack surface with no unprotected entry points. SQL queries are all properly prepared, and output escaping is generally good at 89%. The plugin also implements nonce and capability checks on its AJAX handler and has no known unpatched vulnerabilities. However, the presence of a 'create_function' call is a significant concern as it's a deprecated and potentially insecure PHP function that can be abused to execute arbitrary code. While taint analysis shows no flows, the static code signal is a concrete risk that needs attention. The plugin's vulnerability history, with two medium-severity CVEs (one related to Missing Authorization and another to Cross-site Scripting), despite being patched, suggests a pattern of past security weaknesses that require ongoing vigilance. Overall, the plugin has made improvements in core security practices but the use of 'create_function' introduces a critical potential vulnerability that outweighs its strengths.