WP My Favourites Security & Risk Analysis

The "wp-my-favourites" v1.1.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates a commitment to secure database practices by using prepared statements for all SQL queries and has no recorded vulnerabilities or CVEs. This suggests a generally well-maintained codebase in terms of these aspects. However, significant concerns arise from its attack surface. The plugin exposes 13 AJAX handlers without any authentication or capability checks, creating a large entry point for potential attacks. Furthermore, a critical finding is that 100% of its 26 output operations are not properly escaped. This, combined with the taint analysis revealing 2 flows with unsanitized paths, strongly indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities that could be exploited through the unprotected AJAX endpoints.