ShopApper: Mobile App for WooCommerce Security & Risk Analysis

The "mobile-app-for-woocommerce" plugin v0.4.61 demonstrates a generally good security posture with several positive indicators. All SQL queries are prepared, and a high percentage of output is properly escaped, mitigating common injection and XSS risks. The plugin also implements nonce and capability checks, and its attack surface through AJAX, REST API, and shortcodes appears to be minimal or protected. However, there are two concerning taint analysis flows that were identified with unsanitized paths, though they are not categorized as critical or high severity. This suggests a potential for subtle vulnerabilities that could be exploited if user input is not handled with extreme care.

The plugin's vulnerability history is a significant concern, with one medium severity CVE that remains unpatched. The fact that the last vulnerability was reported very recently (2025-04-14) and is still unpatched indicates a potential for delayed or inadequate security maintenance. The common vulnerability type being Cross-site Scripting further reinforces the need for vigilance in output escaping and input sanitization, even with the current high escaping rate. While the plugin has strengths in its secure coding practices, the presence of unsanitized taint flows and a recent, unpatched vulnerability necessitates a cautious approach.