Immersive Designer – 3D Product Configurator for WooCommerce Security & Risk Analysis

The "immersive-designer" v1.0.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates excellent practices in its SQL query handling, utilizing prepared statements exclusively, and ensuring all output is properly escaped. Furthermore, it has no recorded vulnerability history, suggesting a history of stable and secure development. However, significant concerns arise from its attack surface. The plugin exposes two AJAX handlers, both of which lack any authentication checks. This creates a direct and unprotected entry point into the plugin's functionality, which is a critical security weakness. The taint analysis indicates two flows with unsanitized paths, although they are not classified as critical or high severity, they still represent potential avenues for exploitation if the data sources are user-controlled.