User Box Security & Risk Analysis

The 'users-box' plugin version 1.0.4 exhibits a mixed security posture. On the positive side, the plugin has a remarkably small attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events that could be directly exploited. Furthermore, there is no recorded vulnerability history (CVEs), suggesting a history of stable and secure releases. However, the static code analysis reveals significant concerns. The presence of the `create_function` is a critical red flag, as it's deprecated and can be a source of severe security vulnerabilities, particularly if used with user-supplied input. Additionally, the plugin performs SQL queries without using prepared statements, which opens the door to SQL injection vulnerabilities. The low percentage of properly escaped output further exacerbates these risks, as it indicates a high likelihood of cross-site scripting (XSS) vulnerabilities. While the plugin has no known vulnerabilities historically, the immediate code-level risks are substantial.