Spoki – Chat Buttons and WooCommerce Notifications Security & Risk Analysis

The "spoki" v2.17.0 plugin exhibits a concerning security posture, primarily due to a significant number of unprotected entry points and a history of medium-severity vulnerabilities, including Cross-Site Scripting (XSS). The static analysis reveals a large attack surface with 6 out of 7 entry points lacking any authentication or permission checks. This means that unauthenticated users could potentially interact with these handlers and routes, leading to unintended consequences. Furthermore, the code analysis highlights the presence of the dangerous `unserialize` function, which, when combined with uncontrolled input, can lead to Remote Code Execution vulnerabilities if not handled with extreme caution and proper input validation. The low percentage of properly escaped output (30%) suggests a high risk of XSS vulnerabilities, further exacerbated by the lack of any nonce checks or capability checks on critical entry points. The plugin's vulnerability history, with a recent medium-severity XSS finding, reinforces these concerns. While the use of prepared statements for SQL queries is a positive sign, it does not mitigate the broader risks presented by the insecure entry points and potential for XSS. Overall, the plugin requires significant security improvements to mitigate the risks of unauthorized access and code injection.