Soccr Security & Risk Analysis

The "soccr" plugin v1.6.1 presents a mixed security posture. On the positive side, it has no recorded historical vulnerabilities and avoids dangerous functions. The lack of raw SQL queries and external HTTP requests are also good indicators. However, the plugin has a significant security concern due to a single unprotected AJAX handler, representing its entire attack surface. Furthermore, a very low percentage of its outputs are properly escaped, indicating a high risk of cross-site scripting (XSS) vulnerabilities. The absence of nonce and capability checks on its entry points exacerbates these risks.