Invoice Manager for WooCommerce Security & Risk Analysis

The plugin 'wc-invoice-manager' v1.2.3 demonstrates a generally strong security posture with no recorded vulnerabilities or critical security findings in static and taint analysis. The absence of known CVEs and a history of zero vulnerabilities is a significant positive indicator. The plugin also shows good practices regarding output escaping, with 93% of outputs properly handled, and it implements nonce and capability checks, contributing to a secure interaction model. However, there are areas for concern. The plugin utilizes two SQL queries that are not prepared, which poses a risk of SQL injection if the input is not meticulously sanitized elsewhere. Additionally, the presence of a single external HTTP request without clear context on its security implications warrants attention. The use of bundled libraries like 'dompdf' and 'Guzzle' could also introduce risks if they are outdated or contain their own vulnerabilities, though this is not directly indicated by the provided data. Overall, while the plugin appears robust due to its clean vulnerability history and good sanitization practices, the unescaped SQL queries and the external HTTP request are potential weak points that should be addressed to ensure comprehensive security.