Simple custom post likes Security & Risk Analysis

The plugin "simple-custom-post-likes" v1.0 exhibits a concerning security posture due to multiple unprotected entry points and a lack of robust security practices. The static analysis reveals two AJAX handlers, both lacking authentication checks, creating a significant attack surface. This directly exposes functionality to unauthenticated users, potentially allowing for unauthorized actions. Furthermore, the analysis indicates that 100% of output escaping is improperly implemented, meaning user-supplied data or plugin-generated content could be vulnerable to cross-site scripting (XSS) attacks. While the vulnerability history is clean, this lack of past issues does not negate the identified code-level risks. The presence of raw SQL queries without prepared statements also poses a risk of SQL injection, especially when combined with unsanitized input.