- In includes/user-list.php on line 193 a $_GET parameter is passed through esc_attr() and assigned to a variable. On line 202 it is put unescaped into an SQL query.
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:
The plugin potentially contains an SQL injection vulnerability. It looks like it may be exploitable by non-admins if an admin is convinced to follow a link.