Wishlist and Compare for WooCommerce Security & Risk Analysis

The "wishlist-and-compare" plugin version 1.3.3 exhibits a mixed security posture. While it demonstrates good practices such as 100% of SQL queries using prepared statements and a high rate of output escaping (97%), there are significant concerns regarding its attack surface. The analysis reveals 36 entry points, with a concerning 2 of these lacking proper permission callbacks. This indicates a potential for unauthorized access to certain functionalities.

Taint analysis identified 2 flows with unsanitized paths, which, while not reaching critical or high severity in this specific analysis, still represent a potential risk for data manipulation or injection if not handled with absolute certainty by upstream or downstream processes. The plugin's vulnerability history shows a single high-severity vulnerability in the past, specifically related to Missing Authorization. The fact that this is currently unpatched is a significant red flag, suggesting that users of this version are still exposed to this past risk.

Overall, the plugin has strengths in its SQL handling and output sanitization. However, the presence of unprotected REST API routes and the historical pattern of authorization issues are substantial weaknesses that require immediate attention. The plugin's attack surface is moderately large, and the two unprotected entry points, combined with the historical vulnerability, necessitate caution.