- Puts $_SERVER[‘HTTP_HOST’] into SQL queries without escaping (sunrise.php line 30)
- Uses functions marked “Do not use, deprecated” to escape SQL ($wpdb->escape())
- No consistent use of SQL – escaping is sometimes done with $wpdb->prepare(), sometimes with $wpdb->escape(), and sometimes not at all
Reason for the 'Use with caution' result
The plugin contains or is likely to contain a vulnerability which could be exploited by a privileged user to affect the site’s confidentiality, integrity or availability in a manner exceeding their privileges:
- May be vulnerable to SQL injection.