Shipping Zones by Drawing for WooCommerce Security & Risk Analysis

The "shipping-zones-by-drawing-for-woocommerce" plugin version 3.1.4.3 exhibits a mixed security posture. While it benefits from a clean vulnerability history with no known CVEs and no detected critical or high severity taint flows, there are notable concerns stemming from its static analysis. The plugin presents an attack surface with 6 entry points, one of which is unprotected and lacks authentication checks. Additionally, the single SQL query identified is not using prepared statements, posing a potential risk for SQL injection if user-supplied data is directly incorporated. The output escaping, while generally good at 69%, still leaves room for improvement and could be a vector for cross-site scripting (XSS) vulnerabilities if specific outputs are not properly handled. The plugin also makes external HTTP requests, which, if not carefully validated, could lead to SSRF vulnerabilities. Despite the lack of historical vulnerabilities, the presence of an unprotected AJAX handler and raw SQL queries suggest potential weaknesses that could be exploited if an attacker discovers them. Overall, the plugin has strengths in its lack of historical issues and no critical taint flows, but the identified code-level risks require attention.