Related Products – Create Upsells, Cross-sells, and Product Recommendations for WooCommerce Security & Risk Analysis

The "wt-woocommerce-related-products" plugin version 1.7.6 exhibits a strong security posture based on the provided static analysis. The absence of critical or high severity taint flows, zero unpatched CVEs, and a near-perfect output escaping rate of 99% are significant strengths. The presence of nonce and capability checks on all identified entry points (AJAX handlers and shortcodes) further bolsters its defenses. The plugin appears to follow many best practices for secure WordPress development, with no dangerous functions or file operations detected.

However, a notable concern is the handling of SQL queries. With two total SQL queries and 0% using prepared statements, this presents a significant risk of SQL injection vulnerabilities. While no specific taint flows leading to SQL injection were detected in the limited analysis, the lack of prepared statements creates a clear potential entry point for attackers. The plugin's vulnerability history is clean, which is positive, but it doesn't mitigate the immediate risk posed by the unparameterized SQL queries. Overall, the plugin is well-defended against common attack vectors like XSS and CSRF, but the raw SQL queries represent a critical weakness that requires immediate attention.