All Currencies for WooCommerce Security & Risk Analysis

The "woocommerce-all-currencies" plugin version 2.4.4 exhibits a generally good security posture based on the provided static analysis. The absence of dangerous functions, file operations, and external HTTP requests, coupled with the fact that all SQL queries use prepared statements, are positive indicators. The plugin also demonstrates good practices in output escaping, with 80% of outputs being properly escaped.

However, there are a few areas for concern. The vulnerability history indicates a past medium-severity Cross-site Scripting (XSS) vulnerability. While currently unpatched CVEs are zero, the presence of a historical XSS vulnerability warrants attention. Furthermore, the lack of nonce checks and capability checks across the plugin's entry points, particularly for the single shortcode, is a notable weakness. This could potentially expose the plugin to various attacks if malicious input can be injected or if unauthorized users can trigger shortcode functionality.

In conclusion, while the plugin has strengths in its coding practices regarding SQL and output escaping, the past XSS vulnerability and the absence of critical security checks like nonces and capability checks represent potential risks that should be addressed. Users should ensure they are on the latest version and monitor for future security updates.