Due to the architecture of this code it is extremely difficult to check that all user controlled values are escaped before they are used in unprepared SQL queries. There is a likelihood that this plugin contains SQL injections, in particular because this plugin contains extremely long functions that build SQL strings by appending strings together over time without preparing inputs. This is a pattern we have seen before that usually leads to vulnerabilities.
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability: