WishSuite – Wishlist for WooCommerce Security & Risk Analysis

The "wishsuite" v1.5.3 plugin exhibits a mixed security posture. While it demonstrates good practices by implementing nonce checks and capability checks on all identified entry points, and largely utilizes prepared statements for SQL queries, there are notable areas of concern. The static analysis reveals a significant percentage of improperly escaped output, which presents a risk of Cross-Site Scripting (XSS) vulnerabilities, especially given the plugin's history of XSS CVEs. Furthermore, the taint analysis indicates flows with unsanitized paths, which could potentially lead to file inclusion or path traversal vulnerabilities if not handled carefully in the application logic. The plugin's history of 5 known CVEs, including high and medium severity issues like XSS, PHP Remote File Inclusion, and CSRF, suggests a recurring pattern of vulnerabilities related to input handling and authentication. The most recent vulnerability was reported in December 2025, which is concerning if the current version is v1.5.3. While the current version has no *unpatched* CVEs, the historical pattern and the output escaping and taint analysis findings warrant caution.