Inventory Presser – Car Dealer Listings Security & Risk Analysis

The Inventory Presser plugin v15.2.7 demonstrates a generally good security posture with strong adherence to best practices in several key areas. The plugin excels in output escaping, with 98% of outputs being properly handled, and a high percentage (92%) of SQL queries utilizing prepared statements, significantly mitigating risks like SQL injection. The absence of dangerous functions, critical or high severity taint flows, and bundled libraries further contributes to a robust security foundation. However, there are specific areas that warrant attention. The presence of two unprotected entry points, specifically one AJAX handler and one REST API route lacking permission callbacks, presents a direct attack vector for unauthenticated users. While the vulnerability history shows only one medium severity CVE and no currently unpatched vulnerabilities, the fact that the last vulnerability was in June 2025 (potentially a typo and should be in the past) is concerning. The type of past vulnerability (Cross-site Scripting) coupled with the unprotected entry points suggests a potential for similar issues if input validation is not consistently applied to these exposed handlers.