Experience API for WP Courseware by Grassblade Security & Risk Analysis

The plugin "grassblade-xapi-wp-courseware" v3.1 presents a mixed security posture. On the positive side, it has no recorded vulnerabilities (CVEs), no known dangerous functions used, and a high percentage of its SQL queries utilize prepared statements. It also avoids bundled libraries, which can be a source of outdated or vulnerable code. However, the static analysis reveals significant concerns. The plugin exposes three AJAX handlers, all of which lack authentication checks, creating a substantial attack surface for unauthorized actions. Furthermore, a concerningly low percentage (42%) of its outputs are properly escaped, increasing the risk of cross-site scripting (XSS) vulnerabilities. The absence of nonce checks on the AJAX handlers compounds these risks. While the taint analysis shows no critical or high-severity flows, the combination of unprotected entry points and insufficient output escaping suggests a need for immediate attention to secure these areas.