Kalimah Shortcodes Security & Risk Analysis

The kalimah-shortcodes v1.3.4 plugin presents a mixed security posture. While it exhibits strong practices by not using dangerous functions and performing all SQL queries using prepared statements, several critical security concerns are evident from the static analysis. The presence of two AJAX handlers without any authentication or capability checks creates a significant attack surface. This means any user, regardless of their logged-in status or role, can potentially trigger these handlers, leading to vulnerabilities if they interact with sensitive data or functionality. Furthermore, a very low percentage of output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The lack of any recorded vulnerabilities in its history might suggest a lack of targeted attacks or a historically secure codebase, but it should not overshadow the immediate risks identified in the current static analysis.