Invoice King Pro Security & Risk Analysis

The "invoice-king-pro" v1.1.7 plugin exhibits a mixed security posture. On the positive side, it has a very limited attack surface with only one AJAX handler and no REST API routes, shortcodes, or cron events. Furthermore, there are no recorded CVEs for this plugin, suggesting a history of relative stability and potentially good security practices in the past.

However, significant concerns arise from the static code analysis. The plugin uses a dangerous function, `unserialize`, which is a known vector for deserialization vulnerabilities, especially if the data being unserialized is controlled by an attacker. The analysis also reveals that 100% of SQL queries are not using prepared statements, posing a high risk of SQL injection vulnerabilities. The complete lack of properly escaped output (0%) is a critical flaw, opening the door to cross-site scripting (XSS) attacks. Additionally, the absence of capability checks for its entry points is concerning, as it implies that all users, regardless of their role, might be able to trigger potentially sensitive actions.

While the vulnerability history is currently clean, the numerous code-level weaknesses, particularly the unescaped output and raw SQL queries, present a substantial risk. These are fundamental security failings that could be easily exploited. The presence of `unserialize` is also a red flag. The plugin's strengths lie in its small attack surface and lack of known historical vulnerabilities, but these are overshadowed by critical code-level security flaws that demand immediate attention.