YayCurrency – WooCommerce Multi-Currency Switcher Security & Risk Analysis

The "yaycurrency" plugin v3.3.3 exhibits a mixed security posture. On the positive side, it demonstrates strong practices with 100% of SQL queries utilizing prepared statements and a high rate of output escaping (93%). The absence of file operations and dangerous functions is also encouraging. However, significant concerns arise from the attack surface and taint analysis. The plugin has a considerable number of entry points (37), with 3 of them lacking authentication checks, creating potential access vectors. Furthermore, the taint analysis reveals 5 flows with unsanitized paths, 4 of which are categorized as high severity. This indicates a risk of sensitive data being processed without proper sanitization, potentially leading to exploitable vulnerabilities.

The vulnerability history shows a past pattern of missing authorization and code injection vulnerabilities, with a recent high-severity issue reported in 2026. While there are currently no unpatched CVEs, the recurring nature of these vulnerability types suggests a persistent underlying weakness in how user input is handled or access is controlled. The plugin's strengths lie in its database interaction hygiene, but the identified taint flows and past vulnerabilities point to areas requiring immediate attention regarding input validation and authorization.