MetaViewer – Debug Meta Data Security & Risk Analysis

The 'metaviewer-debug-meta-data' plugin v1.0.0 presents a mixed security posture. On the positive side, it exhibits no known historical vulnerabilities (CVEs) and its static analysis shows a very limited attack surface with no directly exposed AJAX handlers, REST API routes, shortcodes, or cron events. Furthermore, all SQL queries are correctly handled with prepared statements. However, the presence of the `unserialize` function is a significant concern. While no taint flows were detected, `unserialize` can be a gateway to remote code execution if it processes untrusted input. The plugin also demonstrates a concerning lack of output escaping, with only 40% of outputs being properly escaped, leaving it vulnerable to cross-site scripting (XSS) attacks. The absence of nonce checks and the limited capability checks further reduce its security robustness, especially considering the potential risk posed by `unserialize`.