WP Limit Login Attempts Security & Risk Analysis

The 'wp-limit-login-attempts' plugin version 2.6.5 presents a mixed security posture. On the positive side, the static analysis shows no identified dangerous functions, file operations, external HTTP requests, or raw SQL queries executed without prepared statements. The attack surface appears minimal with no exposed AJAX handlers, REST API routes, or shortcodes. However, significant concerns arise from the vulnerability history. With two known CVEs, one of which is critical and currently unpatched, the plugin has a history of serious security flaws, specifically SQL injection. The static analysis also reveals that only 17% of SQL queries use prepared statements, and importantly, none of the four output operations are properly escaped. This indicates a high risk of cross-site scripting (XSS) vulnerabilities.