RPS Image Gallery Security & Risk Analysis

The "rps-image-gallery" plugin version 2.2.7 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and appears to have no known CVEs or historical vulnerabilities. The attack surface is relatively small with no unprotected entry points identified, and it correctly uses capability checks in at least one instance.

However, there are significant concerns. The presence of two dangerous `unserialize` functions without any apparent sanitization or validation is a major red flag, as this is a common vector for remote code execution vulnerabilities. The low percentage of properly escaped output (51%) suggests a high risk of cross-site scripting (XSS) vulnerabilities in the remaining 49% of outputs. The absence of nonce checks, especially given the potential for serialized data to be manipulated, further exacerbates these risks.

Overall, while the plugin benefits from a clean vulnerability history and secure SQL practices, the critical issues related to `unserialize` and widespread output escaping failures create a substantial security risk. These weaknesses outweigh the strengths and necessitate immediate attention.