Quasar form – add-on for WooCommerce Security & Risk Analysis

The static analysis of quasar-form-woo-add-on v1.7 reveals a generally good security posture. The plugin demonstrates a commitment to secure coding practices with 100% of its AJAX handlers and REST API routes being protected by authentication and permission checks respectively. Furthermore, the absence of shortcodes, cron events, file operations, and external HTTP requests significantly limits the potential attack surface. The code signals also show a reasonable application of security measures, with nonce checks and capability checks present, and a majority of SQL queries utilizing prepared statements. However, a concerning aspect is that 78% of SQL queries are not using prepared statements, which could expose the plugin to SQL injection vulnerabilities if not handled with extreme care in the un-prepared queries. The lack of any recorded CVEs, including critical or high severity vulnerabilities, and no recent vulnerabilities suggest a well-maintained and secure plugin history. While the absence of critical taint flows and dangerous functions is a strong positive, the reliance on non-prepared SQL statements presents a potential weakness.