3D viewer by Visody Security & Risk Analysis

The plugin 'visody-3d-product-viewer' v2.4.2 exhibits a generally good security posture with several positive indicators. The absence of known CVEs and critical taint flows is a significant strength. Furthermore, the plugin demonstrates strong practices in SQL query handling, with 100% prepared statements, and a high percentage of properly escaped output (96%). It also includes a reasonable number of nonce and capability checks. However, a notable concern is the presence of an unprotected AJAX handler, which represents a direct attack vector if not handled with extreme caution by the user. The attack surface, while small overall, has a single unprotected entry point, which slightly elevates risk. The bundled Freemius library, while not explicitly flagged as outdated, is a component that should be monitored for security updates. Overall, the plugin is well-developed from a security perspective, but the unprotected AJAX handler requires attention.