Better Customer List for WooCommerce Security & Risk Analysis

The "woo-better-customer-list" plugin version 1.2.3 exhibits a mixed security posture. While it avoids dangerous functions and external HTTP requests, and has a decent percentage of properly escaped output, significant concerns arise from its attack surface and vulnerability history. The plugin exposes two AJAX handlers without any authentication or capability checks, creating a direct entry point for unauthenticated attackers. Furthermore, a taint analysis revealed one flow with an unsanitized path, which could potentially lead to vulnerabilities if exploited, though it's not classified as critical or high severity. The plugin's history of known vulnerabilities, including an unpatched medium severity Cross-Site Scripting (XSS) issue from 2025, is a major red flag. The recurring nature of such vulnerabilities suggests a lack of robust secure coding practices within the development process, particularly in input validation and output sanitization.