Locus Security & Risk Analysis

The plugin "locus" v1.0 exhibits a mixed security posture. On the positive side, there are no reported CVEs, no evidence of taint flows, and all SQL queries utilize prepared statements. File operations and external HTTP requests are also absent, which reduces potential attack vectors. However, several significant concerns are raised by the static analysis. The presence of three instances of `create_function` is a major red flag, as this deprecated function is notoriously prone to security vulnerabilities, particularly code injection. Furthermore, only 5% of output is properly escaped, leaving a substantial portion of the plugin's output vulnerable to Cross-Site Scripting (XSS) attacks. The complete lack of nonce checks and the minimal use of capability checks (only 2) on the identified entry points are also critical weaknesses, meaning that even if entry points existed, they would likely be unprotected against unauthorized actions.