N-letters. Send newsletters to your website's users Security & Risk Analysis

The 'n-letters-send-newsletters-to-your-websites-users' plugin v1.1 exhibits a mixed security posture. On the positive side, there are no reported vulnerabilities in its history, and the static analysis reveals a contained attack surface with all entry points having some form of authentication or capability check. Furthermore, the absence of dangerous functions, file operations, and external HTTP requests are good indicators. However, significant concerns arise from the SQL query handling and output escaping. All three SQL queries are executed without prepared statements, creating a high risk of SQL injection if any user-supplied data is incorporated into these queries. Additionally, only 16% of output operations are properly escaped, leaving a substantial portion vulnerable to Cross-Site Scripting (XSS) attacks. While the plugin has no known CVEs, the identified code weaknesses could be exploited if not addressed, potentially leading to data breaches or site compromise.