ELEX WooCommerce Address Validation & Google Address Autocomplete Plugin Security & Risk Analysis

The "address-validation-address-auto-complete" plugin v1.8.5 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by exclusively using prepared statements for SQL queries, avoiding dangerous functions, and having no file operations or known past vulnerabilities. The absence of critical or high severity taint flows is also reassuring.

However, there are notable concerns. The plugin has a relatively small attack surface, but two of its four AJAX handlers lack authentication checks. This means that unauthenticated users could potentially trigger these actions, opening up possibilities for abuse if the handlers themselves have logical flaws or interact with sensitive data. Additionally, while the majority of output is properly escaped, a significant portion (21%) is not, which could lead to Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is rendered without proper sanitization.

The plugin's vulnerability history is clean, with no recorded CVEs, which is a strong indicator of a generally well-maintained codebase. Nevertheless, the identified unprotected AJAX handlers and the percentage of unescaped output represent potential weaknesses that should be addressed to further strengthen its security.