Quantities and Units for WooCommerce Security & Risk Analysis

The "quantities-and-units-for-woocommerce" plugin version 1.0.13 exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries, performing nonce and capability checks on a significant portion of its entry points, and having a relatively small attack surface with no unprotected AJAX handlers or REST API routes, there are notable concerns. The most significant weakness identified is the complete lack of output escaping across all 60 identified output points. This presents a high risk of Cross-Site Scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into the user interface. Taint analysis also revealed two flows with unsanitized paths, though thankfully these are not classified as critical or high severity. The plugin's vulnerability history, which includes one medium severity XSS vulnerability discovered on September 17, 2025, and still unpatched, further reinforces the concern about output sanitization. This historical pattern suggests a recurring issue with input handling and a potential lack of diligent security review before releases. In conclusion, while the plugin has strengths in its structured approach to SQL and access control, the pervasive issue of unescaped output and a recent unpatched XSS vulnerability create a significant security risk that requires immediate attention.