PDF Invoices Italian Add-on for WooCommerce Security & Risk Analysis

The "woocommerce-pdf-invoices-italian-add-on" plugin v0.7.7 exhibits a mixed security posture. On the positive side, the plugin avoids dangerous functions, uses prepared statements for all SQL queries, has no known CVEs, and no recorded historical vulnerabilities, suggesting a history of responsible development or a lack of targeted attack. However, significant security concerns are present, primarily stemming from the static analysis. The most critical issue is a single AJAX handler that lacks any authentication or authorization checks, presenting a direct and unprotected entry point for potential attackers. Furthermore, a substantial portion of output (73%) is not properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is not sanitized before being displayed. The absence of nonce checks on the AJAX handler is also a notable weakness, increasing the risk of CSRF attacks.