PRIMER by chloédigital Security & Risk Analysis

The "primer-by-chloedigital" plugin v1.0.25 presents a significant security risk due to multiple unprotected AJAX handlers and a concerning lack of proper output escaping and input sanitization. The static analysis reveals a substantial attack surface with all three identified entry points (AJAX handlers) lacking authentication checks. Furthermore, only a small percentage of SQL queries use prepared statements, and a similarly low percentage of output is properly escaped, indicating potential for SQL injection and cross-site scripting vulnerabilities. The presence of dangerous functions like `create_function` adds to the overall insecurity. The vulnerability history, including a known medium severity Cross-site Scripting (XSS) vulnerability that is currently unpatched, reinforces these concerns. While the absence of file operations and external HTTP requests is a positive sign, the current security posture is weak, requiring immediate attention to address the identified risks.