Finale Lite – Sales Countdown Timer & Discount for WooCommerce Security & Risk Analysis

The "finale-woocommerce-sales-countdown-timer-discount" plugin version 2.20.0 presents a mixed security posture. While it demonstrates good practices like using prepared statements for most SQL queries and performing nonce checks on its AJAX handlers, significant concerns remain. The plugin exposes a substantial attack surface with 14 entry points, 7 of which lack authentication checks. This is a major weakness, as it could allow unauthenticated users to trigger potentially sensitive actions. Furthermore, a concerning 46% of output escaping is not properly handled, increasing the risk of Cross-Site Scripting vulnerabilities. The vulnerability history is also a red flag, with 7 known CVEs, including one currently unpatched and a history of high-severity issues like Cross-Site Request Forgery and Missing Authorization. This pattern suggests recurring security weaknesses within the plugin's development lifecycle.