siteselector Security & Risk Analysis

The "siteselector" plugin v1.01 exhibits several significant security concerns, primarily stemming from a large unprotected attack surface and poor output sanitization. While the plugin does not appear to have a history of known vulnerabilities (CVEs), this does not inherently mean it is secure. The static analysis reveals 6 out of 7 entry points are unprotected, with 6 AJAX handlers lacking authentication checks. This creates a substantial risk for unauthorized actions to be performed on a WordPress site. Furthermore, a very low percentage (3%) of output is properly escaped, indicating a high likelihood of Cross-Site Scripting (XSS) vulnerabilities across the plugin's output.