Sticky Action Buttons – Call, Chat, Navigate and more Security & Risk Analysis

The "sticky-action-buttons-call-chat-navigate-and-more" plugin v1.0 exhibits a generally positive security posture, with several good practices in place. The absence of any known CVEs and the consistent use of prepared statements for SQL queries are significant strengths. Furthermore, the static analysis shows all entry points (AJAX handlers) are protected by capability checks, and there are no identified unsanitized paths in the taint analysis.

However, there are a couple of areas that warrant attention. The presence of the `create_function` dangerous function, while not directly exploited in the provided analysis, is a known security risk that can lead to arbitrary code execution if used with user-supplied input. Additionally, a significant portion of the output (29%) is not properly escaped. This could potentially lead to cross-site scripting (XSS) vulnerabilities if the unescaped output contains user-controlled data.

In conclusion, the plugin benefits from robust access control on its entry points and secure database interaction. The primary concerns stem from the use of a deprecated dangerous function and the less-than-ideal output escaping, which collectively represent a moderate risk that should be addressed to further strengthen the plugin's security.