Random Post with ajax Security & Risk Analysis

The 'random-post-ajax' plugin version 0.8.1 presents a significant security risk primarily due to its unprotected AJAX handlers. The static analysis reveals two AJAX entry points, both of which lack any authentication or authorization checks. This means any user, regardless of their logged-in status or role, can trigger these functions, creating a wide attack surface. While the plugin does not appear to use dangerous functions or external HTTP requests, and its SQL queries are properly prepared, the absence of output escaping on all identified outputs is a serious concern. This oversight could lead to Cross-Site Scripting (XSS) vulnerabilities if the data processed by the AJAX handlers is rendered on the frontend without proper sanitization. The plugin's vulnerability history is clean, with no recorded CVEs, which suggests it may not have been a target for attackers or has historically been well-maintained. However, the current lack of protective measures on its AJAX endpoints is a critical weakness that outweighs its positive attributes and requires immediate attention.