spoonacular recipe visualizer Security & Risk Analysis

The "spoonacular-widgets" v1.2.1 plugin exhibits a concerning security posture primarily due to the lack of authentication checks on its AJAX handler and inadequate output escaping. While the plugin has no recorded vulnerabilities in its history, this is overshadowed by immediate risks identified in the static analysis. The presence of one unprotected AJAX handler represents a significant attack surface that could potentially be exploited by unauthenticated users. Furthermore, all identified outputs lack proper escaping, increasing the risk of cross-site scripting (XSS) vulnerabilities. The taint analysis revealing two flows with unsanitized paths, even if not classified as critical or high severity, further adds to these concerns. The absence of nonce checks and capability checks on its entry points are critical oversights. Despite a clean vulnerability history, the current code presents exploitable weaknesses that require immediate attention to improve its overall security.