Leartes TRY Exchange Rates Security & Risk Analysis

The "leartes-try-exchange-rates" v2.1 plugin exhibits a mixed security posture. While the static analysis shows a small attack surface and good practices in SQL query handling, significant concerns arise from the low rate of output escaping (9%) and the complete absence of nonce and capability checks. This suggests a high potential for Cross-Site Scripting (XSS) vulnerabilities, where user-supplied data might be rendered without proper sanitization, allowing attackers to inject malicious scripts. The vulnerability history further amplifies these concerns, with a known medium-severity XSS vulnerability that is currently unpatched. This indicates a pattern of security weaknesses that are not being adequately addressed, posing a tangible risk to websites using this plugin. Despite the positive aspects like the lack of critical taint flows and dangerous functions, the prevalent output escaping issue combined with the unpatched vulnerability strongly advises caution. Users should consider this plugin to have a moderate to high risk due to the ease with which XSS attacks could be executed and the lack of remediation for past flaws.