Product Addons for Woocommerce – Product Options with Custom Fields Security & Risk Analysis

The "woo-custom-product-addons" plugin version 3.1.2 exhibits a mixed security posture. While the attack surface appears to be minimal with no exposed AJAX handlers, REST API routes, shortcodes, or cron events, several code signals raise concerns. Notably, only 46% of output is properly escaped, indicating a potential for Cross-Site Scripting (XSS) vulnerabilities. The presence of two unsanitized paths in the taint analysis, even without critical or high severity, suggests potential weaknesses in input validation. Furthermore, the plugin has a history of high-severity vulnerabilities, specifically related to Code Injection, with a past vulnerability recorded on February 17, 2026. This historical pattern, coupled with the current code signals, suggests that while the attack surface is controlled, the handling of user-supplied data and the potential for code injection remain areas requiring vigilance.

Despite the lack of critical or high severity taint flows in the current version, the historical high-severity Code Injection vulnerability and the low output escaping rate are significant weaknesses. The plugin does perform some capability checks, but the complete absence of nonce checks on AJAX handlers (though there are zero AJAX handlers in this version) and the raw SQL queries are also points of concern. The plugin does not bundle external libraries, which is a positive sign. In conclusion, while the current version presents a reduced direct attack surface, the historical vulnerability and the ongoing issues with output escaping and potential unsanitized paths mean that users should exercise caution and ensure the plugin is kept updated to address any future discovered flaws.