WP Energy Usage Calculator Security & Risk Analysis

The wp-energy-usage-calculator plugin, at version 0.1.2, presents a mixed security posture. On the positive side, there are no recorded vulnerabilities (CVEs) and the static analysis reveals a small attack surface with no apparent AJAX handlers or REST API routes exposed without authentication. Furthermore, no dangerous functions, file operations, external HTTP requests, or bundled libraries were identified, which are generally good indicators. However, significant concerns arise from the code signals. The plugin utilizes SQL queries without prepared statements, and critically, none of its output is properly escaped. This lack of output escaping is a major red flag, opening the door to Cross-Site Scripting (XSS) vulnerabilities, where malicious scripts could be injected into the output displayed to users. The absence of nonce and capability checks also means that any entry point, even the single shortcode, lacks fundamental WordPress security mechanisms to verify user intent and permissions.