SysBasics Customize My Account for WooCommerce – Live My Account Customizer Security & Risk Analysis

The "customize-my-account-for-woocommerce" plugin v3.8.7 exhibits a mixed security posture. While it demonstrates strong practices such as 100% prepared SQL statements and a comprehensive 12 nonce checks, significant concerns arise from its attack surface. A substantial 8 out of 13 total entry points, specifically AJAX handlers, lack authentication checks, presenting a high risk of unauthorized actions or information disclosure. The static analysis also reveals a worrying 34% of output escaping, which indicates a potential for Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not properly handled.

The plugin's vulnerability history, with 3 known medium severity CVEs historically related to XSS and CSRF, reinforces the concern about input sanitization and output escaping. Although there are currently no unpatched vulnerabilities, the pattern suggests a recurring need for developers to address these specific security weaknesses. The inclusion of bundled libraries like Select2 and jQuery v3.4.1, while common, also warrants attention for potential outdated vulnerabilities if not regularly updated. Overall, the plugin has foundational security measures in place but requires immediate attention to its unprotected entry points and output sanitization practices to mitigate significant risks.