Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs Security & Risk Analysis

The "wp-expand-tabs-free" plugin v3.1.3 presents a mixed security posture. While it demonstrates strengths in using prepared statements for SQL queries and a high percentage of properly escaped output, significant concerns remain regarding its attack surface and past vulnerability history. The presence of 3 AJAX handlers without authentication checks exposes potential entry points for unauthorized actions, especially when combined with the use of the dangerous `unserialize` function, which has historically been a vector for deserialization vulnerabilities. The plugin also has a notable history of 5 CVEs, including a high-severity vulnerability in the past, and common types such as deserialization, XSS, and CSRF, indicating recurring security weaknesses. While there are no currently unpatched CVEs and no critical taint flows identified in this specific static analysis, the past vulnerability patterns and the identified unprotected AJAX handlers warrant caution.