Vidjet – Shoppable Videos Security & Risk Analysis

The vidjet v1.1.4 plugin exhibits a mixed security posture. On the positive side, it has no known historical vulnerabilities (CVEs) and demonstrates good practices in output escaping (88%) and SQL query preparation (67%). The absence of bundled libraries and limited external HTTP requests are also favorable indicators. However, significant security concerns arise from the static analysis. The plugin presents a small but unprotected attack surface with two AJAX handlers that lack authentication checks. This is a critical oversight that could allow unauthenticated users to trigger potentially harmful actions. Furthermore, the complete absence of nonce and capability checks on these entry points exacerbates the risk, making it easier for attackers to exploit these vulnerabilities.