LTL Freight Quotes – Worldwide Express Edition Security & Risk Analysis

The "ltl-freight-quotes-worldwide-express-edition" v5.2.2 plugin exhibits a mixed security posture. While it demonstrates some good practices, such as a significant number of capability checks and a moderate use of prepared statements for SQL queries, there are notable areas of concern. The static analysis reveals a substantial attack surface with 4 unprotected entry points, specifically 3 AJAX handlers and 1 REST API route lacking proper authorization. Furthermore, the taint analysis indicates 1 flow of high severity and 10 flows with unsanitized paths, suggesting potential vulnerabilities that could be exploited if data is not handled with sufficient care. The plugin's history of known CVEs, including high and medium severity vulnerabilities such as Cross-Site Scripting and SQL Injection, is a significant red flag. The fact that the last known vulnerability was in early 2025, and there are currently no unpatched CVEs, suggests a recent history of security issues, even if they are presently addressed. This indicates a pattern where security weaknesses have been identified and, ideally, patched in subsequent releases. However, the presence of unprotected entry points and high-severity taint flows in the current version suggests that past issues may not have been entirely eradicated or that new vulnerabilities have emerged.