Simple Pregnancy Calculator Security & Risk Analysis

The 'simple-pregnancy-calculator' plugin version 1.1.2 exhibits a mixed security posture. On the positive side, the plugin has a small attack surface with no AJAX or REST API entry points that lack authentication. Crucially, all identified SQL queries utilize prepared statements, and there are no file operations or external HTTP requests, which significantly reduces common attack vectors. The absence of any recorded vulnerabilities or CVEs in its history further suggests a history of relative security. However, there are notable areas of concern. The low percentage of properly escaped output (29%) is a significant weakness, indicating a high likelihood of cross-site scripting (XSS) vulnerabilities. The complete lack of nonce checks and capability checks, especially given the presence of shortcodes which can be triggered by users, means that these entry points are not adequately protected against unauthorized execution or manipulation. The taint analysis showing zero flows is good, but it is likely limited by the scope of the analysis and the lack of identified input sources. Overall, while the plugin avoids common pitfalls like raw SQL and unauthenticated endpoints, the inadequate output escaping and absence of nonces/capability checks present substantial risks for XSS and unauthorized actions.