Easy Age Verify Security & Risk Analysis

The "easy-age-verify" v2.0.9 plugin presents a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and having no critical or high severity historical vulnerabilities, several significant concerns arise from the static analysis. The most prominent issue is the presence of four AJAX handlers that lack authentication checks. This creates a substantial attack surface where unauthorized users could potentially trigger actions within the plugin, leading to unintended consequences or further exploitation. Furthermore, the plugin exhibits a notable weakness in output escaping, with nearly half of its outputs not being properly sanitized, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities. Although the plugin has a history of only medium and low severity vulnerabilities, the recent vulnerability reported on 2024-06-27, coupled with the current lack of proper input validation on its AJAX endpoints and insufficient output escaping, suggests that new vulnerabilities, potentially of higher severity, could be introduced or exploited.