PopStats Security & Risk Analysis

The static analysis of the "popstats" v3.0 plugin reveals significant security concerns despite a lack of recorded historical vulnerabilities or a large attack surface. The most alarming findings are the extensive use of raw SQL queries without prepared statements and the complete absence of output escaping. This combination presents a high risk of SQL injection and Cross-Site Scripting (XSS) vulnerabilities, respectively. While the plugin has a single nonce check, it lacks capability checks, meaning any user, regardless of their WordPress role, could potentially interact with its functionalities if entry points existed. The taint analysis further corroborates these risks, indicating two flows with unsanitized paths, classified as high severity, directly stemming from the unescaped outputs or raw SQL queries.