WP Meta and Date Remover Security & Risk Analysis

The "wp-meta-and-date-remover" plugin version 2.3.6 presents a mixed security posture. While it demonstrates good practices in SQL query handling with 100% prepared statements and includes one nonce check, the presence of four AJAX handlers without authentication checks is a significant concern, creating a substantial attack surface. Furthermore, only 44% of its output is properly escaped, leaving potential avenues for cross-site scripting vulnerabilities. The vulnerability history shows two known medium severity CVEs, specifically CSRF and XSS, with the most recent occurring in late 2023. Although currently unpatched CVEs are zero, the recurring nature of these vulnerability types and the open AJAX handlers suggest a continued risk. The plugin's strengths lie in its secure database interactions, but the lack of input validation and authentication on its AJAX endpoints, coupled with a history of XSS and CSRF, necessitates caution.