Pickup | Delivery | Dine-in date time Security & Risk Analysis

The 'restaurant-pickup-delivery-dine-in' plugin v1.0.9 exhibits a concerning security posture despite some positive indicators. While the code analysis shows no dangerous functions, no direct SQL queries, and no file operations, the presence of two unprotected AJAX handlers presents a significant entry point for attackers. The fact that 40% of outputs are not properly escaped raises concerns about potential Cross-Site Scripting (XSS) vulnerabilities, especially when combined with the history of an XSS vulnerability in April 2023. This suggests a pattern of input sanitization and output escaping issues. The plugin also has one unpatched medium severity CVE, which is a critical oversight that leaves users exposed to known exploits. Overall, the lack of comprehensive authentication checks on AJAX endpoints, coupled with the historical vulnerability and the presence of unpatched issues, outweighs the positive aspects of the code analysis, making this plugin a moderate to high risk for WordPress sites.