Bookwize Form Security & Risk Analysis

The bookwize-booking-form plugin version 1.9.7 exhibits a mixed security posture. On the positive side, there are no recorded vulnerabilities (CVEs) and the plugin doesn't perform file operations or external HTTP requests. The total attack surface is minimal, with only one shortcode identified and no unprotected entry points based on the static analysis. However, significant concerns arise from the code analysis. A substantial portion of output (94%) is not properly escaped, presenting a high risk of Cross-Site Scripting (XSS) vulnerabilities. Furthermore, 50% of SQL queries are not using prepared statements, which could lead to SQL injection flaws. The taint analysis reveals two flows with unsanitized paths, although they are not flagged as critical or high severity. The absence of nonce checks and a concerningly low capability check count also contribute to the overall risk.