Solar Wizard Lite Security & Risk Analysis

The solar-wizard-lite plugin v1.2.5 exhibits a concerning security posture primarily due to a large attack surface with a significant number of unprotected entry points. While the plugin demonstrates good practices in SQL query handling and shows a high percentage of properly escaped output, the presence of 8 AJAX handlers without any authentication checks is a critical weakness. This could allow unauthenticated users to trigger potentially sensitive actions or expose information. The taint analysis, while limited in scope, identified two flows with unsanitized paths, which, although not classified as critical or high, warrant attention. The vulnerability history indicates a past XSS vulnerability, and the recent date of the last vulnerability suggests the plugin is actively maintained but has had security flaws. Overall, the plugin has strengths in SQL and output escaping but significant risks due to unprotected AJAX endpoints and potential path sanitization issues.