FreeInvoice API Security & Risk Analysis

The 'freeinvoice-api' v1.0.3 plugin exhibits a concerning security posture due to a significant lack of proper authentication and authorization checks, particularly within its AJAX handlers. With one AJAX handler identified as lacking authentication, this presents a direct and easily exploitable attack vector. While the absence of critical or high-severity taint flows is positive, the low percentage of properly escaped output (24%) suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities across various output points. The presence of raw SQL queries (75% not using prepared statements) further heightens the risk of SQL injection attacks. The plugin's vulnerability history is clean, with no recorded CVEs, which could indicate a history of secure development or simply a lack of in-depth auditing. However, the current static analysis findings reveal fundamental security weaknesses that must be addressed.