Super Switch Security & Risk Analysis

The "super-switch" v1.5 plugin presents a concerning security posture despite a seemingly clean vulnerability history. While the plugin boasts zero entry points for direct attacks and a complete absence of known CVEs, its static analysis reveals significant underlying risks. Notably, the presence of 43 instances of the deprecated and inherently unsafe `create_function` is a major red flag, indicating potential for arbitrary code execution if inputs are not meticulously sanitized. Furthermore, the complete lack of output escaping on all identified output points means that any data processed and displayed by the plugin could be vulnerable to Cross-Site Scripting (XSS) attacks, especially if user-supplied data is involved. The absence of nonce checks and capability checks, coupled with no taint analysis data, leaves a significant blind spot regarding how data is handled and if unauthorized actions can be performed. While the plugin does not appear to have a history of publicly disclosed vulnerabilities, this could be due to a lack of thorough auditing or a reliance on external factors for protection, rather than inherent security in its code.