MDC Theme Switcher Security & Risk Analysis

The "mdc-theme-switcher" v3.1.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, exclusively using prepared statements, and has no recorded vulnerabilities or CVEs, suggesting a historically stable and secure codebase. There are no file operations or external HTTP requests, further limiting potential attack vectors. However, significant concerns arise from the attack surface analysis. The plugin exposes two AJAX handlers, both of which lack authentication checks, creating a substantial risk of unauthorized actions. Additionally, a concerning signal is the presence of the `create_function` dangerous function, which can lead to code injection vulnerabilities if not handled with extreme care. The low percentage of properly escaped output (23%) is another significant weakness, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities, especially when combined with the unprotected AJAX endpoints.