Give – Double the Donation Security & Risk Analysis

The "give-double-the-donation" plugin v2.1.2 exhibits a concerning security posture primarily due to its unprotected entry points and weak output escaping. While the plugin demonstrates good practices in database interaction by exclusively using prepared statements and has no recorded vulnerabilities or critical taint flows, the absence of permission callbacks on its two REST API routes presents a significant risk. This means any user, regardless of their role, could potentially interact with these API endpoints, leading to unauthorized actions or information disclosure if the API functionality is not robustly secured internally. The low percentage of properly escaped output (23%) is another major red flag, increasing the likelihood of cross-site scripting (XSS) vulnerabilities where user-supplied data is not properly sanitized before being displayed on the frontend.