CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce Security & Risk Analysis

The 'woocommerce-catalog-enquiry' plugin version 6.0.8 presents a mixed security posture. While the static analysis shows no dangerous functions or critical taint flows, and there are no currently unpatched CVEs, several areas raise concerns. The significant number of unprotected AJAX handlers (4 out of 4) represent a substantial attack surface, making it easier for unauthenticated users to trigger potentially sensitive actions. Furthermore, the code analysis indicates that only 63% of outputs are properly escaped, suggesting a risk of Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not handled carefully. The SQL query practice, with only 24% using prepared statements, is also a weakness that could lead to SQL injection if not meticulously sanitized elsewhere. The plugin's vulnerability history is a significant red flag, with 5 known CVEs including a critical one and a high one, covering common issues like CSRF, XSS, missing authorization, and unrestricted file uploads. While these are reported as patched, the recurring nature of these vulnerability types indicates a pattern of insecure coding practices that require ongoing vigilance. The last vulnerability being from February 2024 suggests that while recent fixes have occurred, the underlying architectural issues may still persist.