Manage Enrollment for LearnDash Security & Risk Analysis

The 'manage-enrollment-learndash' plugin version 1.3 exhibits a mixed security posture. While it has a clean vulnerability history with no recorded CVEs and no identified critical or high severity taint flows, there are significant concerns in its static analysis. The presence of one unprotected AJAX handler represents a direct entry point for potential attacks, especially given the absence of nonce checks across all AJAX handlers. Furthermore, the plugin performs SQL queries without using prepared statements, which can leave it vulnerable to SQL injection attacks if the data is not adequately sanitized beforehand. The relatively high percentage of unescaped output also increases the risk of cross-site scripting (XSS) vulnerabilities. Despite the lack of historical vulnerabilities and no critical taint flows, the identified weaknesses in authentication, SQL handling, and output escaping warrant careful consideration and potential remediation.