Cirrusly Commerce Security & Risk Analysis

The cirrusly-commerce plugin v1.7 exhibits a generally good security posture, primarily due to its diligent use of prepared statements for SQL queries and a high rate of output escaping. The complete absence of known vulnerabilities in its history is a strong indicator of developer attention to security. However, the presence of three AJAX handlers without authentication checks represents a significant potential attack vector. While the taint analysis shows no critical or high-severity unsanitized paths, the four flows with unsanitized paths warrant further investigation, as they could potentially be exploited if user input is not properly handled downstream. The plugin also relies on the Freemius v1.0 bundled library, which, if outdated, could introduce vulnerabilities.