Realty Portal – My Favorites Security & Risk Analysis

The "realty-portal-my-favorites" plugin v0.3.9 exhibits a concerning security posture primarily due to its unprotected AJAX handlers. The static analysis reveals two AJAX entry points, both of which lack proper authentication checks. This is a significant risk as it allows any unauthenticated user to potentially trigger these functions, leading to unintended consequences or access to sensitive data depending on the functionality of these handlers. While the plugin shows strengths in avoiding dangerous functions, raw SQL, and external HTTP requests, and claims to use prepared statements for its SQL queries, the lack of output escaping on 92% of outputs is also a serious weakness. This makes it susceptible to Cross-Site Scripting (XSS) attacks, where malicious scripts can be injected and executed within the user's browser.