Show All Comments Security & Risk Analysis

The "show-all-comments-in-one-page" plugin version 7.0.1 presents a significant security risk. The static analysis reveals a concerning lack of input validation and authorization checks. Two AJAX handlers are exposed without any authentication, creating a direct attack vector. Furthermore, all three SQL queries are executed without prepared statements, leaving the plugin vulnerable to SQL injection attacks. The taint analysis also indicates flows with unsanitized paths, although no critical or high severity issues were found in this specific analysis. The plugin's vulnerability history is a major red flag, with two known CVEs, one of which remains unpatched. The prevalence of Cross-site Scripting vulnerabilities in its history suggests a pattern of insufficient output escaping and improper input neutralization.