SaveTo Wishlist Lite – WooCommerce Wishlist Security & Risk Analysis

The "saveto-wishlist-lite-for-woocommerce" v1.0.4 plugin exhibits a mixed security posture. While it demonstrates strong adherence to output escaping (99%) and a high percentage of prepared statements for SQL queries (85%), significant concerns arise from its extensive attack surface. A notable 13 AJAX handlers are present, with a concerning 12 of them lacking any authentication checks, making them prime targets for unauthorized actions. Additionally, the taint analysis reveals one flow with unsanitized paths classified as high severity, indicating a potential vulnerability to injection attacks or other path manipulation issues. The plugin's vulnerability history is currently clean, with no recorded CVEs, which is a positive indicator of its current state. However, the presence of a high-severity taint flow and a large number of unprotected AJAX endpoints represent immediate and substantial risks that outweigh the lack of historical vulnerabilities. These issues suggest that while the plugin developers have implemented good practices in some areas, there are critical oversights in securing its entry points, leaving it susceptible to exploitation.