Space gallery Security & Risk Analysis

The 'space-gallery' plugin v8.0 exhibits a mixed security posture. On the positive side, it shows no known historical vulnerabilities (CVEs) and no identified dangerous functions or external HTTP requests. All SQL queries are properly prepared, and there are no file operations or bundled libraries to scrutinize. This indicates a generally cautious approach to development in these areas. However, several critical concerns emerge from the static analysis. The plugin has a limited attack surface, with only one shortcode entry point, but it lacks any authentication or capability checks on this entry point. Furthermore, a significant portion of its output (69%) is not properly escaped, posing a risk for cross-site scripting (XSS) vulnerabilities. The taint analysis reveals two flows with unsanitized paths, although these did not reach a critical or high severity in the current analysis.