NextGEN Custom Fields Security & Risk Analysis

The plugin 'nextgen-gallery-custom-fields' v1.2.5 exhibits a mixed security posture. On one hand, it has no recorded vulnerabilities (CVEs), no external HTTP requests, and no file operations, which are positive indicators. The attack surface is also reported as zero entry points, which, if accurate, is excellent. However, the static analysis reveals significant concerns within the code itself. A substantial percentage of SQL queries (77%) are not using prepared statements, indicating a high risk of SQL injection vulnerabilities. Furthermore, a worrying 76% of output is not properly escaped, pointing to a strong likelihood of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis specifically flags two high-severity flows with unsanitized paths, directly corroborating the risks of injection attacks.