LiveVisi – Live Visitors Activity Tracker for WP Website Security & Risk Analysis

The "livevisi" v1.0.1 plugin exhibits a mixed security posture. While it shows good practices in avoiding dangerous functions, performing file operations, and a relatively high percentage of prepared statements and output escaping, several areas raise concerns. The presence of REST API routes without permission callbacks represents a significant attack surface that could lead to unauthorized access or actions if exploited. The taint analysis also indicates a potential issue with unsanitized paths, even though it's not classified as critical. The plugin's clean vulnerability history is a positive sign, suggesting a history of secure development or diligent patching by developers. However, the identified entry points without proper authentication checks are a direct risk that needs immediate attention. Overall, the plugin has strengths in its core development practices, but the lack of robust access control on certain REST API endpoints is a notable weakness that warrants caution.