Kento Splash Screen Security & Risk Analysis

The "kento-splash-screen" plugin, version 1.4, exhibits a mixed security posture. While it demonstrates good practices by avoiding dangerous functions, utilizing prepared statements for all SQL queries, and having no external HTTP requests or file operations, significant concerns remain. A critical finding is the complete lack of output escaping, meaning all 29 outputs are potentially vulnerable to cross-site scripting (XSS) attacks. Additionally, the plugin has a known unpatched medium severity CVE from August 2025, indicating a recent and ongoing security risk. The presence of a taint flow with unsanitized paths, even if not currently categorized as critical or high, warrants attention as it suggests potential vulnerabilities if exploited correctly. The absence of nonce and capability checks on its single shortcode entry point also increases its attack surface, though it has no direct AJAX or REST API entry points.