Adwised Web Push Notification Security & Risk Analysis

The adwised v2.5.7 plugin exhibits a concerning security posture due to a significant number of unprotected entry points. While the plugin demonstrates good practices in its handling of SQL queries, employing prepared statements exclusively, and has no recorded vulnerability history, these strengths are overshadowed by the lack of authorization checks on its AJAX handlers and REST API routes. This creates a broad attack surface, allowing unauthenticated users to potentially interact with sensitive functionalities. Although taint analysis did not reveal critical or high severity unsanitized paths, the presence of one unsanitized path flow warrants attention. The plugin also shows a weakness in output escaping, with a substantial portion of outputs not being properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities. The absence of any known vulnerabilities to date is a positive sign, but it does not mitigate the immediate risks posed by the identified architectural weaknesses.