Shipping for Nova Poshta Security & Risk Analysis

The "nova-poshta-ttn" plugin version 1.19.8 presents a mixed security posture. While it shows positive signs like using prepared statements for a majority of its SQL queries and performing some output escaping, significant concerns arise from its attack surface and taint analysis. The plugin exposes a substantial number of AJAX handlers (19) with no authentication checks, creating a broad entry point for potential attackers. Furthermore, taint analysis reveals 11 flows with unsanitized paths, including 4 designated as high severity, indicating a real risk of data manipulation or unauthorized access if these flows can be triggered by user-supplied input. The history of a previously disclosed high-severity SQL injection vulnerability, though currently patched, reinforces the importance of vigilance regarding input sanitization.