We’re Open! Security & Risk Analysis

The 'opening-hours' plugin v2.6 presents a mixed security posture. On the positive side, the static analysis indicates strong adherence to WordPress security best practices with a high percentage of properly escaped output, a significant number of nonce and capability checks, and no identified dangerous functions. The absence of unpatched CVEs and a lack of critical or high-severity vulnerabilities in its history are also reassuring signs. However, the presence of 3 SQL queries that do not use prepared statements is a notable concern, as this can be a gateway for SQL injection vulnerabilities if not handled with extreme care in all contexts. Additionally, the two identified flows with unsanitized paths, while not categorized as critical or high in the taint analysis, warrant careful review as they represent potential vectors for unexpected behavior or information disclosure.