User Spam Remover Security & Risk Analysis

The User Spam Remover plugin v1.1 exhibits a mixed security posture. While the static analysis reveals a commendable absence of direct attack surface entry points like AJAX handlers, REST API routes, and shortcodes without proper authorization checks, and all SQL queries are prepared, there are significant concerns regarding output escaping. Only 24% of outputs are properly escaped, which presents a substantial risk of Cross-Site Scripting (XSS) vulnerabilities. The plugin also performs several file operations, which, combined with the poor output escaping, could lead to more complex attack chains if malicious input is not handled carefully.

The vulnerability history is particularly worrying. The plugin has a history of two medium-severity vulnerabilities, both related to Exposure of Sensitive Information to an Unauthorized Actor. Crucially, one of these vulnerabilities remains unpatched, indicating a lack of ongoing maintenance and a direct, known security risk. The last vulnerability being dated in late 2025 suggests either a very recent discovery of past issues or potentially a forward-looking data entry error; however, the existence of an unpatched CVE is a critical flag.

In conclusion, while the plugin demonstrates good practices in limiting its attack surface and using prepared statements for SQL, the severe lack of output escaping and the presence of an unpatched CVE significantly outweigh these positives. The plugin is at a considerable risk of security compromise due to known, unaddressed vulnerabilities and potential for XSS attacks.