Live Scores for SportsPress Security & Risk Analysis

The 'live-scores-for-sportspress' plugin v1.9.2 exhibits a concerning security posture due to several factors. While it has a moderate number of entry points, the presence of three unprotected AJAX handlers significantly increases the attack surface. The static analysis also reveals a complete lack of prepared statements for SQL queries, which is a critical vulnerability that can lead to SQL injection. Furthermore, a low percentage of properly escaped output suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history, including two past CVEs (one high and one medium severity), reinforces these concerns, highlighting a pattern of 'PHP Remote File Inclusion' and 'Cross-site Scripting' which are serious security flaws. Although there are no currently unpatched vulnerabilities and the taint analysis did not reveal critical or high severity flows, the combination of unprotected entry points, unescaped output, raw SQL queries, and historical vulnerabilities indicates a need for significant improvement in the plugin's security practices.