LCT Useful Shortcodes & Functions Security & Risk Analysis

The lct-useful-shortcodes-functions plugin version 2025.04 exhibits a concerning security posture, despite having no recorded historical vulnerabilities. The static analysis reveals a significant number of entry points, with a notable portion of AJAX handlers lacking authentication checks, creating potential attack vectors. The presence of dangerous functions like unserialize and shell_exec, coupled with a high percentage of unsanitized paths in taint analysis flows, raises serious alarms about code injection and command execution risks. While the plugin demonstrates good practices in SQL query preparation and capability checks, the limited output escaping and extensive file operations coupled with a single external HTTP request could be exploited in conjunction with other weaknesses. The lack of historical CVEs is positive but does not negate the present risks identified through static and taint analysis. Overall, the plugin has potential for severe security flaws due to its unprotected entry points and vulnerable code patterns.