Request a Quote Pro by Aavoya Security & Risk Analysis

The 'request-a-quote-pro-by-aavoya' v2022.11 plugin exhibits a concerning security posture primarily due to a large number of unprotected AJAX handlers. While the plugin demonstrates good practices in other areas such as using prepared statements for SQL queries and a high percentage of properly escaped output, the sheer volume of entry points without proper authentication checks creates a significant attack surface. The taint analysis reveals several flows with unsanitized paths, including a concerning number of high severity issues. This suggests that user-supplied data, if not properly validated and sanitized before being used in these flows, could lead to exploitable vulnerabilities, despite the lack of recorded CVEs. The absence of known vulnerabilities in its history is a positive sign, but it does not negate the risks identified in the static and taint analysis of the current version.