DeliveryPlus Security & Risk Analysis

The deliveryplus-by-invisible-dragon plugin, version 1.7, presents a mixed security posture. While it shows strengths in its avoidance of dangerous functions, SQL injection vulnerabilities through prepared statements, and no recorded historical CVEs, significant concerns arise from its attack surface and output escaping. The plugin exposes two AJAX handlers without any authentication checks, creating a direct entry point for unauthorized actions or information disclosure if these handlers perform sensitive operations. Furthermore, a concerning 62% of its output is not properly escaped, posing a high risk of cross-site scripting (XSS) vulnerabilities. The absence of nonce checks on AJAX handlers exacerbates the risk associated with these unprotected entry points. The lack of historical vulnerabilities might indicate past diligence or simply a lack of exploitation attempts, but the current static analysis reveals clear areas for improvement.