Shortcode Maker Security & Risk Analysis

The "shortcode-maker" plugin version 5.0.4.2 exhibits a mixed security posture. While it demonstrates good practices by exclusively using prepared statements for SQL queries and lacking any known CVEs, significant concerns arise from its attack surface. A substantial portion of its entry points, specifically 5 out of 6, lack authentication checks. Furthermore, the static analysis reveals that only a very small percentage (2%) of its numerous output operations are properly escaped, indicating a high risk of cross-site scripting (XSS) vulnerabilities. The taint analysis, although limited in scope, identified flows with unsanitized paths, which could be exploited if combined with the unauthenticated entry points and unescaped output.