Food Store – Online Food Delivery & Pickup Security & Risk Analysis

The 'food-store' plugin v1.5.4 exhibits a mixed security posture. While it demonstrates good practices in SQL query handling (92% prepared statements) and incorporates nonce and capability checks, several significant concerns remain. The static analysis reveals a substantial number of unsanitized paths in taint flows (8 out of 9 analyzed), indicating potential weaknesses in how user input is processed, despite no critical or high severity taint issues being flagged. Furthermore, only 56% of output escaping is properly done, suggesting a moderate risk of Cross-Site Scripting (XSS) vulnerabilities. The plugin's vulnerability history is also a major concern, with two known CVEs, one of which is currently unpatched. The common types of past vulnerabilities, XSS and CSRF, align with the potential risks identified in the static analysis. The presence of an unpatched medium severity vulnerability is a clear and present danger.