SpendeOnline.org Security & Risk Analysis

The spendeonline v3.0.2 plugin exhibits a mixed security posture. On the positive side, the static analysis reveals strong adherence to secure coding practices, with 100% of SQL queries utilizing prepared statements, all output being properly escaped, and no dangerous functions or file operations detected. Furthermore, the attack surface appears minimal, with no unprotected AJAX handlers or REST API routes, and no cron events. However, a significant concern arises from the vulnerability history. The plugin has a known medium severity CVE related to Cross-site Scripting (XSS), which is concerning despite it being currently patched. The absence of nonce checks and capability checks on entry points is a notable weakness, especially given the XSS history, as it could allow for unauthorized actions if an attacker can trigger the shortcode or other entry points without proper validation. The single external HTTP request also warrants attention for potential supply chain risks or vulnerabilities in the external service.