[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTlC_705DTYFxCms7W7WA7rw3xQCNm3KlgfP2vPqIGkw":3,"$f63t9W1utEs0tII7INjCBfacO7HJd1TtPfx3YL4G0J3w":307,"$fSuf-j6J9XMdAueWfAQbkTPJDErtENUkblXXBQHpDeso":311},{"slug":4,"name":5,"version":6,"author":4,"author_profile":7,"description":8,"short_description":9,"active_installs":10,"downloaded":11,"rating":12,"num_ratings":13,"last_updated":14,"tested_up_to":15,"requires_at_least":16,"requires_php":17,"tags":18,"homepage":20,"download_link":21,"security_score":22,"vuln_count":23,"unpatched_count":23,"last_vuln_date":24,"fetched_at":25,"discovery_status":26,"vulnerabilities":27,"developer":28,"crawl_stats":24,"alternatives":32,"analysis":33,"fingerprints":288},"abrestan","abrestan Accounting","2.2.6","https:\u002F\u002Fprofiles.wordpress.org\u002Fabrestan\u002F","\u003Cp>This plugin helps connect your (online) store to abrestan online accounting software. By using this plugin, saving products, contacts, and orders in your store will also save them automatically in your abrestan account. Besides that, just after a client pays a bill, the receipt document will be stored in abrestan as well. Of course, you have to register your account in abrestan first. To do so, visit abrestan at the link here www.abrestan.com and sign up for free. After you signed up and entered your account, choose your business, then in the settings menu\u002FAPI, you can find the API keys for the business and import them to the plugin settings. Now your module is ready to use.\u003C\u002Fp>\n\u003Cp>For more information and a full guide to how to use abrestan and WooCommerce Plugin, visit abrestan’s website and go to the “Accounting School” menu.\u003C\u002Fp>\n","Connect abrestan Online Accounting to WooCommerce.",10,1531,20,1,"2023-04-25T11:34:00.000Z","5.8.13","5.2","7.1",[19],"accounting-cloud-abrestan","http:\u002F\u002Fabrestan.com","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fabrestan.zip",85,0,null,"2026-04-16T10:56:18.058Z","no_bundle",[],{"slug":4,"display_name":4,"profile_url":7,"plugin_count":13,"total_installs":10,"avg_security_score":22,"avg_patch_time_days":29,"trust_score":30,"computed_at":31},30,84,"2026-08-28T23:45:13.536Z",[],{"attackSurface":34,"codeSignals":123,"taintFlows":156,"riskAssessment":276,"analyzedAt":287},{"hooks":35,"ajaxHandlers":82,"restRoutes":120,"shortcodes":121,"cronEvents":122,"entryPointCount":67,"unprotectedCount":67},[36,42,46,50,54,60,64,68,73,77],{"type":37,"name":38,"callback":39,"file":40,"line":41},"action","woocommerce_init","woocommerce_loaded","abrestan.php",28,{"type":37,"name":43,"callback":44,"priority":10,"file":40,"line":45},"wp_trash_post","delete_factor",423,{"type":37,"name":47,"callback":48,"priority":10,"file":40,"line":49},"woocommerce_update_order","edit_factor",424,{"type":37,"name":51,"callback":52,"priority":10,"file":40,"line":53},"woocommerce_order_status_completed","abrestan_woocommerce_order_status_completed",425,{"type":55,"name":56,"callback":57,"file":58,"line":59},"filter","manage_edit-shop_order_columns","wc_new_order_column","inc\\Api\\AddColumn.php",11,{"type":37,"name":61,"callback":62,"file":58,"line":63},"manage_shop_order_posts_custom_column","cw_add_order_profit_column_content",12,{"type":37,"name":65,"callback":66,"file":58,"line":67},"admin_print_styles","cw_add_order_profit_column_style",14,{"type":37,"name":69,"callback":70,"file":71,"line":72},"admin_enqueue_scripts","enqueue","inc\\Base\\ABR_Enqueue.php",8,{"type":37,"name":74,"callback":75,"file":76,"line":59},"add_meta_boxes","add_meta_boxesws","inc\\Base\\order_metabox.php",{"type":37,"name":78,"callback":79,"file":80,"line":81},"admin_menu","addAdminMenu","inc\\Base\\SettingApi.php",13,[83,87,90,93,95,98,100,103,105,108,110,113,115,118],{"action":84,"nopriv":85,"callback":84,"hasNonce":85,"hasCapCheck":85,"file":40,"line":86},"abrestan_login_action",false,197,{"action":84,"nopriv":88,"callback":84,"hasNonce":85,"hasCapCheck":85,"file":40,"line":89},true,198,{"action":91,"nopriv":85,"callback":91,"hasNonce":85,"hasCapCheck":85,"file":40,"line":92},"abrestan_logout_action",207,{"action":91,"nopriv":88,"callback":91,"hasNonce":85,"hasCapCheck":85,"file":40,"line":94},208,{"action":96,"nopriv":85,"callback":96,"hasNonce":85,"hasCapCheck":85,"file":40,"line":97},"abrestan_company_action",216,{"action":96,"nopriv":88,"callback":96,"hasNonce":85,"hasCapCheck":85,"file":40,"line":99},217,{"action":101,"nopriv":85,"callback":101,"hasNonce":85,"hasCapCheck":85,"file":40,"line":102},"abrestan_get_orders_action",225,{"action":101,"nopriv":88,"callback":101,"hasNonce":85,"hasCapCheck":85,"file":40,"line":104},226,{"action":106,"nopriv":85,"callback":106,"hasNonce":85,"hasCapCheck":85,"file":40,"line":107},"abrestan_send_orders_action",235,{"action":106,"nopriv":88,"callback":106,"hasNonce":85,"hasCapCheck":85,"file":40,"line":109},236,{"action":111,"nopriv":85,"callback":111,"hasNonce":85,"hasCapCheck":85,"file":40,"line":112},"abrestan_send_again_orders_action",257,{"action":111,"nopriv":88,"callback":111,"hasNonce":85,"hasCapCheck":85,"file":40,"line":114},258,{"action":116,"nopriv":85,"callback":116,"hasNonce":85,"hasCapCheck":85,"file":40,"line":117},"abrestan_save_setting_action",298,{"action":116,"nopriv":88,"callback":116,"hasNonce":85,"hasCapCheck":85,"file":40,"line":119},299,[],[],[],{"dangerousFunctions":124,"sqlUsage":125,"outputEscaping":131,"fileOperations":126,"externalRequests":13,"nonceChecks":23,"capabilityChecks":23,"bundledLibraries":155},[],{"prepared":126,"raw":13,"locations":127},5,[128],{"file":40,"line":129,"context":130},174,"$wpdb->get_results() with variable interpolation",{"escaped":132,"rawEcho":10,"locations":133},50,[134,137,139,141,143,145,147,149,150,152],{"file":40,"line":135,"context":136},203,"raw output",{"file":40,"line":138,"context":136},212,{"file":40,"line":140,"context":136},221,{"file":40,"line":142,"context":136},230,{"file":40,"line":144,"context":136},253,{"file":40,"line":146,"context":136},294,{"file":40,"line":148,"context":136},303,{"file":58,"line":41,"context":136},{"file":58,"line":151,"context":136},36,{"file":153,"line":154,"context":136},"templates\\admin\\admin.php",25,[],[157,173,182,191,214,243,263],{"entryPoint":158,"graph":159,"unsanitizedCount":13,"severity":172},"abrestan_login_action (abrestan.php:199)",{"nodes":160,"edges":170},[161,165],{"id":162,"type":163,"label":164,"file":40,"line":135},"n0","source","$_REQUEST['abrestan_username']",{"id":166,"type":167,"label":168,"file":40,"line":135,"wp_function":169},"n1","sink","echo() [XSS]","echo",[171],{"from":162,"to":166,"sanitized":85},"medium",{"entryPoint":174,"graph":175,"unsanitizedCount":13,"severity":172},"abrestan_company_action (abrestan.php:218)",{"nodes":176,"edges":180},[177,179],{"id":162,"type":163,"label":178,"file":40,"line":140},"$_REQUEST['company_code']",{"id":166,"type":167,"label":168,"file":40,"line":140,"wp_function":169},[181],{"from":162,"to":166,"sanitized":85},{"entryPoint":183,"graph":184,"unsanitizedCount":13,"severity":172},"abrestan_get_orders_action (abrestan.php:227)",{"nodes":185,"edges":189},[186,188],{"id":162,"type":163,"label":187,"file":40,"line":142},"$_REQUEST['order_from_date']",{"id":166,"type":167,"label":168,"file":40,"line":142,"wp_function":169},[190],{"from":162,"to":166,"sanitized":85},{"entryPoint":192,"graph":193,"unsanitizedCount":213,"severity":172},"abrestan_save_setting_action (abrestan.php:300)",{"nodes":194,"edges":209},[195,197,198,200,204],{"id":162,"type":163,"label":196,"file":40,"line":148},"$_REQUEST",{"id":166,"type":167,"label":168,"file":40,"line":148,"wp_function":169},{"id":199,"type":163,"label":196,"file":40,"line":148},"n2",{"id":201,"type":202,"label":203,"file":40,"line":148},"n3","transform","→ Save_data()",{"id":205,"type":167,"label":206,"file":207,"line":63,"wp_function":208},"n4","update_option() [Settings Manipulation]","inc\\Controller\\SaveSetting.php","update_option",[210,211,212],{"from":162,"to":166,"sanitized":85},{"from":199,"to":201,"sanitized":85},{"from":201,"to":205,"sanitized":85},2,{"entryPoint":215,"graph":216,"unsanitizedCount":126,"severity":242},"\u003Cabrestan> (abrestan.php:0)",{"nodes":217,"edges":235},[218,219,220,221,222,223,225,227,229,231,233],{"id":162,"type":163,"label":164,"file":40,"line":135},{"id":166,"type":167,"label":168,"file":40,"line":135,"wp_function":169},{"id":199,"type":163,"label":178,"file":40,"line":140},{"id":201,"type":167,"label":168,"file":40,"line":140,"wp_function":169},{"id":205,"type":163,"label":187,"file":40,"line":142},{"id":224,"type":167,"label":168,"file":40,"line":142,"wp_function":169},"n5",{"id":226,"type":163,"label":196,"file":40,"line":148},"n6",{"id":228,"type":167,"label":168,"file":40,"line":148,"wp_function":169},"n7",{"id":230,"type":163,"label":196,"file":40,"line":148},"n8",{"id":232,"type":202,"label":203,"file":40,"line":148},"n9",{"id":234,"type":167,"label":206,"file":207,"line":63,"wp_function":208},"n10",[236,237,238,239,240,241],{"from":162,"to":166,"sanitized":85},{"from":199,"to":201,"sanitized":85},{"from":205,"to":224,"sanitized":85},{"from":226,"to":228,"sanitized":85},{"from":230,"to":232,"sanitized":85},{"from":232,"to":234,"sanitized":85},"low",{"entryPoint":244,"graph":245,"unsanitizedCount":23,"severity":242},"sun (inc\\Base\\order_metabox.php:24)",{"nodes":246,"edges":259},[247,250,251,253,255],{"id":162,"type":163,"label":248,"file":76,"line":249},"$_REQUEST (x2)",27,{"id":166,"type":167,"label":168,"file":76,"line":151,"wp_function":169},{"id":199,"type":163,"label":196,"file":76,"line":252},40,{"id":201,"type":202,"label":254,"file":76,"line":252},"→ abrestanGetOrderByOrderId()",{"id":205,"type":167,"label":256,"file":40,"line":257,"wp_function":258},"get_results() [SQLi]",134,"get_results",[260,261,262],{"from":162,"to":166,"sanitized":88},{"from":199,"to":201,"sanitized":85},{"from":201,"to":205,"sanitized":88},{"entryPoint":264,"graph":265,"unsanitizedCount":23,"severity":242},"\u003Corder_metabox> (inc\\Base\\order_metabox.php:0)",{"nodes":266,"edges":272},[267,268,269,270,271],{"id":162,"type":163,"label":248,"file":76,"line":249},{"id":166,"type":167,"label":168,"file":76,"line":151,"wp_function":169},{"id":199,"type":163,"label":196,"file":76,"line":252},{"id":201,"type":202,"label":254,"file":76,"line":252},{"id":205,"type":167,"label":256,"file":40,"line":257,"wp_function":258},[273,274,275],{"from":162,"to":166,"sanitized":88},{"from":199,"to":201,"sanitized":85},{"from":201,"to":205,"sanitized":88},{"summary":277,"deductions":278},"The abrestan plugin v2.2.6 presents a significant security concern due to its unprotected entry points. With 14 AJAX handlers, none of which implement authentication or capability checks, an attacker could potentially trigger any of these functions without prior authorization. This large, unprotected attack surface is a primary risk. While the plugin shows good practices in using prepared statements for SQL queries and properly escaping most outputs, the lack of security checks on its AJAX endpoints overshadows these strengths. The taint analysis indicates flows with unsanitized paths, though none reached critical or high severity levels, this still suggests potential for indirect vulnerabilities if combined with other weaknesses or future code changes.\n\nThe plugin's vulnerability history is clean, with no recorded CVEs. This is a positive indicator, suggesting that past development may have been secure or that the plugin hasn't been a target for known exploits. However, the absence of past vulnerabilities does not guarantee future security, especially given the identified structural weaknesses in the current version. The lack of nonce checks and capability checks on AJAX handlers is a critical oversight that needs immediate attention. Overall, the plugin's security posture is weak due to its exposed AJAX handlers, despite some good practices in data handling.",[279,281,283,285],{"reason":280,"points":10},"14 unprotected AJAX handlers",{"reason":282,"points":72},"0 nonce checks on AJAX handlers",{"reason":284,"points":72},"0 capability checks on AJAX handlers",{"reason":286,"points":126},"5 flows with unsanitized paths","2026-03-17T00:34:08.083Z",{"wat":289,"direct":298},{"assetPaths":290,"generatorPatterns":293,"scriptPaths":294,"versionParams":295},[291,292],"\u002Fwp-content\u002Fplugins\u002Fabrestan\u002Fcss\u002Fabrestan.css","\u002Fwp-content\u002Fplugins\u002Fabrestan\u002Fjs\u002Fabrestan.js",[],[292],[296,297],"abrestan\u002Fcss\u002Fabrestan.css?ver=","abrestan\u002Fjs\u002Fabrestan.js?ver=",{"cssClasses":299,"htmlComments":300,"htmlAttributes":301,"restEndpoints":302,"jsGlobals":304,"shortcodeOutput":306},[],[],[],[303],"\u002Fwp-json\u002Fabrestan\u002Fv1\u002Fget_logs",[305],"abrestan_ajax_object",[],{"error":88,"url":308,"statusCode":309,"statusMessage":310,"message":310},"http:\u002F\u002Flocalhost\u002Fapi\u002Fplugins\u002Fabrestan\u002Fbundle",404,"no bundle for this plugin yet",{"slug":4,"current_version":6,"total_versions":312,"versions":313},4,[314,321,328,335],{"version":315,"download_url":316,"svn_tag_url":317,"released_at":24,"has_diff":85,"diff_files_changed":318,"diff_lines":24,"trac_diff_url":319,"vulnerabilities":320,"is_current":85},"2.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fabrestan.2.2.2.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fabrestan\u002Ftags\u002F2.2.2\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fabrestan%2Ftags%2F2.2.1&new_path=%2Fabrestan%2Ftags%2F2.2.2",[],{"version":322,"download_url":323,"svn_tag_url":324,"released_at":24,"has_diff":85,"diff_files_changed":325,"diff_lines":24,"trac_diff_url":326,"vulnerabilities":327,"is_current":85},"2.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fabrestan.2.2.1.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fabrestan\u002Ftags\u002F2.2.1\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fabrestan%2Ftags%2F2.2.0&new_path=%2Fabrestan%2Ftags%2F2.2.1",[],{"version":329,"download_url":330,"svn_tag_url":331,"released_at":24,"has_diff":85,"diff_files_changed":332,"diff_lines":24,"trac_diff_url":333,"vulnerabilities":334,"is_current":85},"2.2.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fabrestan.2.2.0.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fabrestan\u002Ftags\u002F2.2.0\u002F",[],"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset?old_path=%2Fabrestan%2Ftags%2F2.1.3&new_path=%2Fabrestan%2Ftags%2F2.2.0",[],{"version":336,"download_url":337,"svn_tag_url":338,"released_at":24,"has_diff":85,"diff_files_changed":339,"diff_lines":24,"trac_diff_url":24,"vulnerabilities":340,"is_current":85},"2.1.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fabrestan.2.1.3.zip","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fabrestan\u002Ftags\u002F2.1.3\u002F",[],[]]