NS Custom Css Security & Risk Analysis

The "ns-custom-css" v2.2.4 plugin exhibits a mixed security posture. While it demonstrates good practices in handling SQL queries with prepared statements and has no recorded vulnerability history, significant concerns arise from its attack surface and output escaping. The presence of two AJAX handlers without authentication checks represents a direct and substantial risk, as any unauthenticated user could potentially interact with these endpoints, leading to unintended actions or information disclosure depending on their functionality. Furthermore, the low percentage (13%) of properly escaped output suggests a high likelihood of cross-site scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the user interface.