SCM – Smart Currency Manager Security & Risk Analysis

The "scd-smart-currency-detector" plugin v4.7.10.6 exhibits several concerning security practices, despite a clean vulnerability history. The static analysis reveals a substantial attack surface, with 13 AJAX handlers, of which 11 lack any authentication checks. This represents a significant risk, as unauthenticated users could potentially trigger these handlers. Furthermore, the plugin uses raw SQL queries without prepared statements for 2 queries, which can be susceptible to SQL injection attacks. While the taint analysis did not uncover critical or high severity flaws, the presence of a flow with an unsanitized path is a red flag, hinting at potential vulnerabilities if exploited. The low percentage of properly escaped output (33%) also indicates a risk of cross-site scripting (XSS) vulnerabilities. The absence of known CVEs is positive, but it does not negate the inherent risks identified in the code's structure and implementation.