Discounts & Promotions Automation Security & Risk Analysis

The 'woocommerce-discounts-plus' v3.7.2 plugin exhibits a generally good security posture, with a significant majority of its outputs being properly escaped and all SQL queries utilizing prepared statements. The plugin also demonstrates a strong use of nonce and capability checks across its AJAX handlers and other entry points, with no unprotected entry points identified in the static analysis. However, there is one identified flow with an unsanitized path, indicating a potential for vulnerabilities if user-controlled input is not handled with sufficient sanitization in that specific instance. While this flow is not categorized as critical or high severity by the taint analysis, it warrants attention. The plugin's vulnerability history shows one medium severity CVE recorded in 2021, related to Cross-Site Scripting. The absence of currently unpatched vulnerabilities and the fact that the last known vulnerability is over two years old suggests that past issues have been addressed, but the past occurrence of XSS highlights the importance of continued vigilance in input sanitization and output escaping.