ProHotspots Lite – Image Gallery Hotspots Security & Risk Analysis

The 'prohotpoints-gallery' v1.0.0 plugin exhibits a concerning security posture due to significant unprotected entry points. While the static analysis reveals no dangerous functions, SQL injection risks (100% prepared statements), and all outputs are properly escaped, the absence of authorization checks on its two AJAX handlers is a critical oversight. This lack of protection means that any unauthenticated user could potentially trigger these AJAX actions, leading to unintended consequences depending on their functionality. The plugin also shows no history of vulnerabilities, which might suggest good development practices or simply that it hasn't been targeted or extensively analyzed. However, the presence of unprotected AJAX endpoints represents a clear and immediate risk that needs to be addressed.