Is this plugin safe to run?

wpdb::_insert_replace_helper() will escape the data:

return $this->query( $this->prepare( $sql, $data ) );

But still … the base64 encoded string looks odd. That should have been four separate parameters, I think.