Ninja Forms Merge Tag Addon Security & Risk Analysis

The nf-merge-tag-addon v2.8 plugin exhibits a strong security posture based on the provided static analysis and vulnerability history. The plugin has zero known CVEs and demonstrates good coding practices, including 100% of SQL queries using prepared statements and a high percentage (89%) of output properly escaped. The absence of file operations, external HTTP requests, and a clean taint analysis further bolster its security. The presence of nonces and capability checks indicates an effort to protect its entry points, although the static analysis reports zero entry points, which could imply these checks are present but not actively triggered by the analyzed code paths. There are no reported vulnerabilities in its history, suggesting a consistent focus on security by the developers.