Food Business Gross Profit Calculator Plugin Security & Risk Analysis

The food-business-gross-profit-calculator plugin, version 1.1, exhibits a concerning security posture primarily due to its unprotected AJAX handlers and a complete lack of output escaping. While the absence of dangerous functions, direct SQL injection risks, and any recorded historical vulnerabilities are positive indicators, these strengths are overshadowed by the identified weaknesses. The plugin presents two AJAX entry points that lack any form of authentication or capability checks, meaning any unauthenticated user could potentially trigger these functions, leading to unintended actions or information disclosure if these handlers perform sensitive operations. Furthermore, the fact that 100% of outputs are unescaped is a significant vulnerability, opening the door to Cross-Site Scripting (XSS) attacks. Attackers could inject malicious scripts through user-controlled inputs that are processed by these handlers, which would then be rendered unescaped in the browser. The plugin's vulnerability history is clean, which is good, but it doesn't negate the current risks identified in the static analysis. The presence of the DataTables library is noted, but its version is not specified, so its security posture is unknown without further investigation. Overall, this plugin requires immediate attention to address the critical security flaws in its AJAX handlers and output sanitization.