Course Scheduler for LearnDash Security & Risk Analysis

The 'course-scheduler-for-learndash' plugin exhibits a mixed security posture. While it has a clean vulnerability history with no known CVEs and a relatively low number of SQL queries, a significant concern arises from its attack surface. The plugin exposes five out of six AJAX handlers without proper authentication checks, creating a substantial risk of unauthorized actions being performed. Furthermore, only 3 out of 7 total entry points have capability checks, leaving many avenues potentially open to unprivileged users. The absence of taint analysis findings and dangerous functions is positive, but it does not mitigate the clear risks introduced by the unprotected AJAX endpoints. The plugin also shows some concerning practices in output escaping, with 31% of outputs not properly escaped, which could lead to cross-site scripting vulnerabilities.