Hide Widgets (SP Display Widgets) Security & Risk Analysis

The sp-display-widgets plugin version 1.0.0 exhibits several security concerns despite a clean vulnerability history. The plugin has a small attack surface, with only one entry point identified. However, this single AJAX handler lacks any authentication or capability checks, making it a significant risk. While the plugin demonstrates good practices by using prepared statements for all SQL queries and having no file operations or external HTTP requests, these strengths are overshadowed by the unprotected AJAX handler and poor output escaping. A staggering 96% of output operations are not properly escaped, opening the door to potential Cross-Site Scripting (XSS) vulnerabilities. The taint analysis reveals one flow with unsanitized paths, which, though not rated as critical or high, warrants attention given the lack of output escaping.