Refer A Friend for WooCommerce by WPGens Security & Risk Analysis

The plugin 'refer-a-friend-for-woocommerce-by-wpgens' v1.3.5 exhibits a mixed security posture. On the positive side, it demonstrates good practices in its handling of SQL queries, exclusively using prepared statements, and has no recorded vulnerabilities or CVEs. This suggests a history of stable and relatively secure development. However, the static analysis reveals significant concerns. The plugin has a single identifiable entry point via an AJAX handler that lacks any authentication checks. This creates a direct and unprotected attack vector. Furthermore, a substantial portion (73%) of its output is not properly escaped, which could lead to Cross-Site Scripting (XSS) vulnerabilities if malicious data is processed and displayed to users. The absence of nonce checks on the AJAX handler exacerbates this risk.