WP Nutrition Facts Security & Risk Analysis

The "wp-nutrition-facts" v1.0.2 plugin presents a mixed security posture. On one hand, it demonstrates good practices by not making external HTTP requests, not performing file operations, and utilizing prepared statements for its SQL queries, which significantly reduces common web application vulnerabilities. The absence of known CVEs and a clean vulnerability history further contribute to a positive security outlook, suggesting that the plugin has historically been well-maintained or has not attracted significant security research.

However, several concerning code signals raise red flags. The presence of a `create_function` call is a critical security concern, as this function is deprecated and can lead to arbitrary code execution if not handled with extreme care, especially in older PHP versions. Furthermore, a very low percentage of properly escaped output (6%) indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities. The lack of nonce checks, despite having a single entry point via a shortcode, is also a significant weakness, potentially allowing for Cross-Site Request Forgery (CSRF) attacks.

In conclusion, while the plugin benefits from a clean vulnerability history and a limited attack surface, the identified code signals, particularly `create_function` and widespread unescaped output, present significant and exploitable security risks. These issues necessitate immediate attention and remediation to ensure the plugin's security.