Neexa | Sales and Enrollment AI Agent for B2C Businesses and Schools Security & Risk Analysis

The neexa-ai v2.1.0 plugin presents a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and has no recorded vulnerabilities or CVEs. This suggests a diligent approach to core security areas. However, the plugin has a significant concern regarding its attack surface. It exposes three AJAX handlers, all of which lack authentication checks, creating a direct entry point for unauthenticated actions. While taint analysis did not reveal critical or high severity issues, two flows with unsanitized paths are present, which warrants attention. Furthermore, the output escaping is only 42% proper, indicating a risk of Cross-Site Scripting (XSS) vulnerabilities in exposed areas. The absence of historical vulnerabilities is a good sign, but the current static analysis findings, particularly the unprotected AJAX endpoints and poor output escaping, introduce notable risks that need to be addressed.