MSTW League Manager Security & Risk Analysis

The "mstw-league-manager" v2.10 plugin exhibits a concerning security posture, primarily due to a significant number of unprotected AJAX handlers and a lack of proper input sanitization for file operations. While the plugin avoids dangerous functions and external HTTP requests, the presence of raw SQL queries and a low percentage of properly escaped output outputs indicate potential vulnerabilities that could be exploited. The historical vulnerability data, which includes a medium-severity CVE, suggests a recurring pattern of security weaknesses. Despite some good practices like the use of capability checks and nonces in a limited capacity, the overall risk is elevated by the unprotected entry points and the critical findings in the taint analysis.