LTL Freight Quotes – Unishippers Edition Security & Risk Analysis

The "ltl-freight-quotes-unishippers-edition" plugin, version 2.5.18, exhibits a mixed security posture. While it demonstrates good practices in areas like SQL prepared statements (59%) and output escaping (83%), significant concerns arise from its attack surface. The presence of 35 AJAX handlers with 3 lacking authentication checks, and 1 REST API route without a permission callback, exposes potential entry points for unauthorized actions. The taint analysis reveals a high-severity flow with unsanitized input, which, combined with the missing authorization checks, presents a tangible risk of exploitation.

The vulnerability history of this plugin is also a cause for concern. With 3 known CVEs, including a high-severity SQL Injection and Cross-site Scripting, the pattern suggests recurring security weaknesses. Although there are currently no unpatched CVEs, the historical prevalence of critical and high-severity issues, coupled with the recent vulnerability in February 2025, indicates a need for continued vigilance and prompt patching when new vulnerabilities are discovered. The plugin's strengths lie in its generally good handling of SQL queries and output, but the identified unauthenticated entry points and past vulnerability trends necessitate careful consideration of its security implications.