Currency Switcher for WooCommerce by WBW Security & Risk Analysis

The 'woo-currency' plugin v2.2.6 presents a mixed security posture. While the attack surface appears minimal with no identified AJAX handlers, REST API routes, shortcodes, or cron events, indicating a good defensive design in terms of entry points, several code signals raise concerns. The presence of dangerous functions like 'unserialize' and 'popen' is a significant red flag, potentially allowing for code execution if used with untrusted input. Furthermore, the extremely low percentage of properly escaped output (6%) suggests a high likelihood of Cross-Site Scripting (XSS) vulnerabilities, where malicious scripts could be injected into the website. The taint analysis, while showing no critical or high severity flows, did reveal that all analyzed flows had unsanitized paths, reinforcing the XSS risk. The plugin's vulnerability history shows one medium severity CVE related to XSS, which was patched, but the pattern of XSS vulnerabilities in the past, combined with the current static analysis findings, indicates a persistent risk. Despite the low attack surface and existing patches, the extensive use of unescaped output and the presence of dangerous functions warrant caution.