Sliced Invoices – WordPress Invoice Plugin Security & Risk Analysis

The Sliced Invoices plugin, version 3.10.0, presents a mixed security posture. While it demonstrates some good practices such as a significant percentage of properly escaped outputs and the use of prepared statements in a majority of its SQL queries, notable concerns exist. The static analysis reveals a substantial attack surface with 9 AJAX handlers, 6 of which lack authentication checks, indicating a potential for unauthorized actions. The taint analysis found several flows with unsanitized paths, though thankfully none reached critical or high severity levels in this version. The plugin's vulnerability history is a significant red flag, with 4 known CVEs and one high-severity, currently unpatched vulnerability. The pattern of past vulnerabilities, including missing authorization, XSS, and SQL injection, further emphasizes the need for vigilance.