LJ Subpages Widget Security & Risk Analysis

The lj-subpages-widget plugin v1.3 exhibits a mixed security posture. On the positive side, it has no recorded vulnerabilities (CVEs) and its SQL queries are all properly prepared, indicating good practices in database interaction. The absence of an attack surface from AJAX, REST API, shortcodes, and cron events is also a strength, as it minimizes direct entry points for attackers.

However, significant concerns arise from the static code analysis. The presence of the `create_function` function is a critical security risk, as it can lead to arbitrary code execution if user-supplied data is passed to it without proper sanitization. Furthermore, the fact that 100% of output is not properly escaped is a major vulnerability. This opens the door to cross-site scripting (XSS) attacks, where malicious scripts could be injected into the website's pages, impacting users.

The lack of nonce checks and capability checks, coupled with the use of `create_function` and unescaped output, suggests a disregard for fundamental WordPress security practices. While the plugin has no historical vulnerabilities, this may be due to limited exposure or the fact that the existing vulnerabilities have not yet been exploited. The current code presents significant risks that should be addressed.