Authentication by LoginRadius Security & Risk Analysis

The 'loginradius-for-wordpress' plugin version 7.3.0 exhibits a mixed security posture. On the positive side, there are no recorded vulnerabilities (CVEs) and the plugin shows good practice in limiting its attack surface, with no unprotected AJAX handlers or REST API routes. However, the code analysis reveals significant concerns, particularly regarding the handling of SQL queries. All three SQL queries are executed without prepared statements, which presents a substantial risk of SQL injection vulnerabilities. Additionally, a notable portion of output is not properly escaped (62%), increasing the potential for cross-site scripting (XSS) attacks. The presence of a taint flow with an unsanitized path, while not classified as critical or high, still indicates a potential for data leakage or manipulation if exploited.