Parex Bridge for Quickbooks & Xero Security & Risk Analysis

This plugin exhibits several significant security concerns, particularly regarding its handling of AJAX requests. The static analysis reveals that both identified AJAX handlers lack proper authentication checks. This creates a substantial attack surface where unauthenticated users could potentially trigger actions within the plugin, leading to unintended consequences or exploitation. Furthermore, the plugin's SQL queries are not being prepared, which, while not flagged as a critical taint flow in this analysis, presents a risk of SQL injection if user input is directly incorporated into these queries. The low percentage of properly escaped output is also concerning, as it increases the likelihood of cross-site scripting (XSS) vulnerabilities.