ScheduleWing – Online Booking and Appointment Schedule Security & Risk Analysis

The booking-chatwing plugin v0.0.2 exhibits a mixed security posture. On the positive side, there are no known CVEs, and the code does not appear to use dangerous functions or make raw SQL queries. It also correctly utilizes prepared statements for its SQL interactions, which is a strong security practice. However, there are significant concerns regarding output escaping, with only 41% of outputs being properly escaped, indicating a potential for Cross-Site Scripting (XSS) vulnerabilities. Furthermore, the taint analysis reveals two flows with unsanitized paths, which could lead to various injection vulnerabilities if these paths are exposed to user input without proper sanitization. The absence of capability checks for its entry points is a critical oversight, as it means any authenticated user could potentially interact with these functions without proper authorization.