FloristPress for Woo – Customize your eCommerce store for your Florist Security & Risk Analysis

The 'bakkbone-florist-companion' plugin v7.8.2 exhibits a mixed security posture. While the absence of critical or high severity taint flows and no currently unpatched CVEs are positive indicators, several areas raise concern. The static analysis reveals a significant attack surface with 8 AJAX handlers, two of which lack authentication checks. This presents a direct avenue for unauthorized actions if these endpoints are exploitable. Furthermore, the high percentage of SQL queries (93%) not using prepared statements is a substantial risk, potentially leading to SQL injection vulnerabilities. The output escaping also falls short, with only 45% properly escaped, increasing the likelihood of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history, while showing no currently critical or high issues, does indicate a pattern of past XSS and missing authorization vulnerabilities, suggesting these are recurring weaknesses that require diligent patching. In conclusion, while the plugin has no immediate critical flaws based on the provided data, the existing structural weaknesses in authentication, SQL query handling, and output sanitization, coupled with a history of similar vulnerabilities, necessitate careful monitoring and potential remediation.