KeyWord Collector Security & Risk Analysis

The "keyword-collector" plugin v1.4 presents a mixed security posture. While it demonstrates good practices in its handling of SQL queries, all of which utilize prepared statements, and a clean vulnerability history with no recorded CVEs, several concerning aspects were identified in the static analysis. The presence of a dangerous function like `unserialize` without evident sanitization or capability checks raises significant concerns regarding potential arbitrary code execution or object injection vulnerabilities. Furthermore, the plugin exposes an unprotected AJAX handler, which is a direct entry point for attackers to potentially exploit other weaknesses. The low percentage of properly escaped output also suggests a risk of Cross-Site Scripting (XSS) vulnerabilities.