Foodlist Security & Risk Analysis

The foodlist plugin v1.13 exhibits a concerning security posture despite a clean vulnerability history and a seemingly small attack surface. The static analysis reveals significant weaknesses in output escaping, with 100% of identified output not being properly escaped. This is a critical vulnerability, as it opens the door to Cross-Site Scripting (XSS) attacks if any user-supplied data is displayed without proper sanitization. The absence of nonce checks and capability checks, coupled with a complete lack of authentication checks on AJAX handlers and permission callbacks for REST API routes (though none are present, the potential remains), further exacerbates the risk. The plugin also bundles an outdated version of Select2 (v3.4.2), which could itself contain undiscovered vulnerabilities.