WP-Lister Lite for eBay Security & Risk Analysis

The 'wp-lister-for-ebay' plugin v3.8.7 exhibits a mixed security posture. While it demonstrates some strengths like a high percentage of SQL queries using prepared statements and a significant number of nonce and capability checks, there are several areas of concern. The presence of 10 unprotected AJAX handlers represents a substantial attack surface that could be exploited without proper authentication. Furthermore, the taint analysis reveals 5 high-severity flows with unsanitized paths, indicating potential for data injection vulnerabilities. The plugin's history of 7 known CVEs, including one high-severity vulnerability and six medium-severity ones, with the latest identified in February 2026, suggests a pattern of past security weaknesses. This history, coupled with the current code analysis findings, warrants caution.