SCM – Smart Currency Manager – Premium Variant for Dokan Security & Risk Analysis

The plugin 'scd-smart-currency-detector-variant-for-dokan' v4.8.0.1 exhibits a mixed security posture. While it has a clean vulnerability history with no known CVEs, the static analysis reveals significant concerns regarding its attack surface and data handling. A substantial portion of its AJAX handlers (8 out of 8) lack authentication checks, creating a large entry point for potential unauthorized actions. Furthermore, all identified taint flows (3 out of 3) indicate unsanitized paths, which could lead to vulnerabilities if not properly handled, even though they are not currently classified as critical or high severity. The plugin also shows moderate concerns with output escaping, with 52% of outputs properly escaped, suggesting potential for cross-site scripting vulnerabilities in the remaining 48%.