Price Per Unit For WooCommerce Security & Risk Analysis

The 'price-per-unit-for-woocommerce' plugin, version 1.3.3, exhibits a generally strong security posture based on the provided static analysis and vulnerability history. The absence of known CVEs and the plugin's focus on secure coding practices like prepared SQL statements and a good percentage of output escaping are positive indicators. The plugin also demonstrates awareness of WordPress security through the inclusion of nonce and capability checks on its entry points, and the attack surface appears to be well-protected.

However, there are minor areas for improvement. While the percentage of properly escaped output is good at 80%, the remaining 20% could potentially lead to cross-site scripting (XSS) vulnerabilities if the unescaped data is user-controllable or sourced from untrusted inputs. Taint analysis revealed no critical or high-severity issues, which is reassuring, but the limited scope of analysis (1 flow) means this is not exhaustive. The plugin's vulnerability history is clean, suggesting a history of secure development, but this also means there's less data to infer patterns of past security weaknesses.

Overall, this plugin appears to be relatively secure, with good adherence to core WordPress security principles. The main concern lies in the unescaped output, which, while not critical in this analysis, warrants attention. The clean vulnerability history is a significant strength.