Pricing Table by Supsystic Security & Risk Analysis

The plugin "pricing-table-by-supsystic" v1.10.02 presents a mixed security posture. While the static analysis reveals a limited attack surface with no identified unprotected entry points and a decent percentage of SQL queries using prepared statements, several concerning signals are present. The use of the `unserialize` function three times is a significant risk, as it can lead to deserialization vulnerabilities if not handled with extreme care and validation. Additionally, the low percentage of properly escaped output (33%) suggests a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history is also a major red flag, with six known CVEs, including four high-severity ones, and a recent vulnerability reported in April 2024. The common vulnerability types like Injection, XSS, SQL Injection, CSRF, and Missing Authorization indicate recurring security weaknesses within the plugin's development over time. The lack of currently unpatched CVEs is a positive, but the pattern of past vulnerabilities and the identified code signals like unserialize and poor output escaping create a notable risk.