Modern Footnotes Security & Risk Analysis

The 'modern-footnotes' plugin version 1.4.20 exhibits a mixed security posture. On the positive side, the static analysis indicates a clean code base with no dangerous functions, no raw SQL queries, and no file operations or external HTTP requests. The presence of capability checks (3) and the absence of any critical or high-severity taint flows are also encouraging signs. However, the significant concern lies in its vulnerability history. With three known medium-severity vulnerabilities, all of which were Cross-site Scripting (XSS) related, this pattern suggests recurring input sanitization or output escaping issues. While all past vulnerabilities are currently unpatched, the fact that the last vulnerability was in the future (2025-06-19) is likely a data anomaly and should be disregarded. The plugin's attack surface is relatively small, consisting of two shortcodes, but the fact that 35% of its outputs are not properly escaped presents a potential XSS risk, even if not explicitly identified as a critical or high severity taint flow in the current analysis. The lack of nonce checks on any entry points is also a weakness that could be exploited in conjunction with other issues.