Catalog Booster & Product Catalog Mode for WooCommerce Security & Risk Analysis

The plugin "catalog-booster-for-woocommerce" v1.2.8 exhibits a mixed security posture. On the positive side, it avoids dangerous functions, doesn't perform file operations, and its SQL queries are all secured with prepared statements. The absence of known CVEs and historical vulnerabilities is also a strong indicator of good maintenance and secure coding practices in the past. However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers that completely lack authentication checks. This creates a substantial attack surface that could be exploited by unauthenticated users to trigger potentially harmful actions within the plugin. Furthermore, a notable portion of output escaping is missing (only 31% properly escaped), which can lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is not properly sanitized before being displayed.