Easy 3D Viewer Security & Risk Analysis

The "woo-3d-viewer" plugin v1.8.7 presents a mixed security posture. While the majority of output is properly escaped and there are no critical or high severity taint flows, several areas warrant concern. The presence of one unprotected AJAX handler significantly increases the attack surface, as it can be triggered without authentication. Furthermore, the plugin exclusively uses raw SQL queries without prepared statements, which is a major security risk. The vulnerability history indicates a past medium severity Cross-Site Scripting (XSS) vulnerability, suggesting a pattern of input sanitization issues that could re-emerge if not carefully addressed.

Although the plugin shows strengths in output escaping and a lack of bundled libraries, the unprotected AJAX endpoint, raw SQL queries, and past XSS vulnerability are significant risks. The plugin needs to implement proper authentication and authorization checks on its AJAX handler and adopt prepared statements for all SQL queries to mitigate these vulnerabilities and improve its overall security. The medium severity XSS vulnerability, even if patched, highlights a potential weakness in how user-supplied data is handled.