WP-Parsi navigation trees Security & Risk Analysis

The wp-parsi-navigation-trees plugin v2.1 exhibits a generally strong security posture based on the provided static analysis. It has a commendably small attack surface, with no identified AJAX handlers, REST API routes, shortcodes, or cron events that lack authentication or permission checks. The absence of dangerous functions, file operations, external HTTP requests, and bundled libraries further bolsters its security. However, the plugin presents significant risks due to its handling of SQL queries and output. All SQL queries are executed without prepared statements, leaving the door open to SQL injection vulnerabilities. Additionally, none of the identified output operations are properly escaped, which creates a risk of Cross-Site Scripting (XSS) attacks. The lack of any recorded vulnerability history is positive, but it does not negate the immediate and significant risks introduced by unescaped output and raw SQL queries.