WP Yelp Review Slider Security & Risk Analysis

The wp-yelp-review-slider plugin exhibits a mixed security posture. While it demonstrates good practices such as a reasonable number of nonce and capability checks, and the absence of bundled libraries, several concerning areas exist. The static analysis reveals a significant attack surface with 3 out of 4 entry points lacking authentication checks, including AJAX handlers. Furthermore, only 50% of output is properly escaped, and 46% of SQL queries do not use prepared statements, indicating potential vulnerabilities for cross-site scripting (XSS) and SQL injection, respectively. The vulnerability history, with 2 known CVEs including a high and medium severity SQL injection, reinforces these concerns and suggests a recurring pattern of input validation and sanitization issues. Although there are no currently unpatched vulnerabilities, the past history and static analysis findings point to areas that require immediate attention to mitigate risks.