Shadows Security & Risk Analysis

The plugin "shadows" v0.3.5 demonstrates a concerning lack of security best practices despite its clean vulnerability history. While the absence of known CVEs and the use of prepared statements for SQL are positive indicators, the analysis reveals significant weaknesses. Specifically, 100% of observed output is not properly escaped, posing a high risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the taint analysis shows flows with unsanitized paths, which could lead to unintended behavior or data exposure if an attacker can influence these paths. The complete lack of nonce and capability checks across all entry points is a critical oversight, leaving the plugin vulnerable to various attacks, including CSRF and unauthorized actions, even with a seemingly small attack surface.