Lanyrd Splat Widget Security & Risk Analysis

The lanyrd-splat-widget plugin v0.0.2 exhibits a mixed security posture. On one hand, the complete absence of known vulnerabilities and CVEs, coupled with the exclusive use of prepared statements for SQL queries, suggests a history of stable and potentially secure development. The plugin also demonstrates no external HTTP requests or file operations, which are common vectors for attacks.

However, the static analysis reveals significant concerns. The presence of the `create_function` dangerous function is a major red flag, as it can be used to execute arbitrary PHP code and is deprecated. Furthermore, a concerningly low output escaping rate (32%) indicates a high likelihood of cross-site scripting (XSS) vulnerabilities, especially given the lack of capability checks and nonce checks, meaning any entry point, if discovered, could be exploited to inject malicious scripts.

While the current attack surface appears limited and the vulnerability history is clean, the identified code signals point to underlying weaknesses. The reliance on `create_function` and the poor output escaping practices present substantial risks that could be exploited if an attacker finds a way to interact with the plugin's code. Therefore, despite the clean history, the plugin requires immediate attention to address these critical coding flaws.