WCBox Lite – Product Slider Plugin For Woocommerce Security & Risk Analysis

The "wcbox-lite" v1.1 plugin exhibits a mixed security posture. While it has no recorded vulnerability history, indicating a potentially stable track record, the static analysis reveals several concerning areas. The presence of an unprotected AJAX handler represents a significant entry point that could be exploited without proper authentication. Furthermore, the taint analysis highlights two flows with unsanitized paths, both classified as high severity. This suggests a risk of malicious data being processed without adequate validation, potentially leading to code injection or other vulnerabilities.

The code analysis also points to the use of a dangerous function, `create_function`, which is known to have security implications. Coupled with the fact that none of the SQL queries use prepared statements and a very low percentage (2%) of outputs are properly escaped, the plugin appears to lack fundamental security best practices in handling data and user input. The limited attack surface and the presence of nonce and capability checks are positive signs, but they are overshadowed by the identified high-severity risks and the overall lack of robust input validation and output escaping.