AWSA Shipping – Advanced Shipping for Woocommerce and Dokan Security & Risk Analysis

The awsa-shipping v1.3.0 plugin demonstrates a generally strong security posture, with a notable absence of dangerous functions and SQL injection vulnerabilities due to prepared statements. The plugin also implements a good number of nonce checks. However, the presence of unsanitized paths in the taint analysis indicates potential security weaknesses that could be exploited if they lead to exploitable vulnerabilities. The historically documented Cross-site Scripting (XSS) vulnerability, even if it is in the past, raises concerns about the plugin's historical ability to properly neutralize user-provided input, and the fact that there is still an unpatched vulnerability is a significant risk.

While the static analysis shows a small attack surface and no immediate critical or high severity issues in the current version's code, the existence of an unpatched medium severity vulnerability from the past, coupled with the taint analysis findings, suggests that careful attention is still required. The plugin has strengths in its handling of SQL and the number of nonce checks, but the historical XSS and the taint findings highlight areas where input sanitization and output escaping might still need further review to ensure complete security.