GS Simple WC Price History

v1.0.0WordPress PluginAudited Today

HIGH

WP.org

Total Findings

Security Grade

Coding Score

100/100

Security Findings

Critical0

High7

Medium32

Low27

Info6

Executive Summary

GS Simple WC Price History is a focused WooCommerce plugin for EU Omnibus Directive compliance that tracks product price history and displays the lowest price before a sale. The codebase is well-structured, demonstrates awareness of common WordPress security patterns (nonce verification, capability checks, prepared statements), and includes thoughtful performance optimisations such as batch-prefetching variation history to avoid N+1 queries. Two medium-severity issues require attention: the shortcode outputs an unescaped wc_price() HTML string directly into a data attribute (potential XSS via attribute injection), and the uninstall.php uses a raw LIKE query without $wpdb->prepare() (SQL injection risk limited to administrators). Several low-severity and informational items round out the report, including a missing LIMIT on the uninstall transient cleanup query, hardcoded UI strings in JavaScript that bypass the translation system, and the absence of a multisite-aware uninstall routine. Overall the plugin is in good shape for a private deployment. The two medium findings should be resolved before any public distribution, and the low/info items represent coding-standards improvements rather than exploitable vulnerabilities.

Security Report Card

securityA

standardsA

qualityD

compatibilityB

OverallB

Readiness

Production Ready

Needs Work

WP.org Ready

Needs Changes

EAA Compliance

Needs Work

Coding Standards

100/100

PHP Compatibility

Requires PHP 5.6

Categories with Findings

databaseCoding StandardsPlugin LifecycleAccessibilityCross-Site ScriptingSQL InjectionType SafetyWordPress CompatibilityWooCommerce Compatibilityhook-wiringPerformancesecurityPHP CompatibilityError HandlingMultisitecompatibilityInternationalizationDependenciesLogging & DebugData PrivacyUpdate Safety

Positive Observations

Nonce verification is correctly implemented for the AJAX delete endpoint — wp_verify_nonce() is called before any data processing, and the nonce field is output via wp_nonce_field() in the metabox.
All AJAX handlers are registered under wp_ajax_ (authenticated only) — no wp_ajax_nopriv_ exposure for destructive operations.
Capability check (manage_woocommerce) is applied both in the admin script enqueue function and in the AJAX handler, providing defence in depth.
All database queries use $wpdb->prepare() with typed placeholders (%d, %s, %f) for user-controlled values.
The N+1 query problem for variable product variations is proactively solved with a batch-prefetch pattern using a static $history_cache.
A request-level static $runtime_cache prevents redundant lowest-price calculations within a single page load.
The activation hook correctly uses dbDelta() for schema management and sets up a composite index (product_id, date_gmt) for efficient range queries.
The deactivation hook properly clears the scheduled cron event to avoid orphaned cron jobs.
The uninstall.php correctly checks for WP_UNINSTALL_PLUGIN before executing, preventing direct file access.
Product status checks (draft, auto-draft, trash) prevent recording prices for unpublished products.

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

[![GS Simple WC Price History security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/wc-price-history-simple)](https://wphealthkit.com/directory/wc-price-history-simple)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Audit Your Plugin

Get a comprehensive security audit for your WordPress plugin or theme. Upload your zip and get results in minutes.

Start Free Audit

Readiness

Production Ready

Needs Work

WP.org Ready

Needs Changes

EAA Compliance

Needs Work

Coding Standards

100/100

PHP Compatibility

Requires PHP 5.6

Categories with Findings

Positive Observations

Nonce verification is correctly implemented for the AJAX delete endpoint — wp_verify_nonce() is called before any data processing, and the nonce field is output via wp_nonce_field() in the metabox.
All AJAX handlers are registered under wp_ajax_ (authenticated only) — no wp_ajax_nopriv_ exposure for destructive operations.
Capability check (manage_woocommerce) is applied both in the admin script enqueue function and in the AJAX handler, providing defence in depth.
All database queries use $wpdb->prepare() with typed placeholders (%d, %s, %f) for user-controlled values.
The N+1 query problem for variable product variations is proactively solved with a batch-prefetch pattern using a static $history_cache.
A request-level static $runtime_cache prevents redundant lowest-price calculations within a single page load.
The activation hook correctly uses dbDelta() for schema management and sets up a composite index (product_id, date_gmt) for efficient range queries.
The deactivation hook properly clears the scheduled cron event to avoid orphaned cron jobs.
The uninstall.php correctly checks for WP_UNINSTALL_PLUGIN before executing, preventing direct file access.
Product status checks (draft, auto-draft, trash) prevent recording prices for unpublished products.

The ABSPATH guard is present at the top of the main plugin file.

Output in the admin metabox consistently uses esc_html() for all database-sourced values.

The plugin correctly avoids tracking variable parent products and only records individual variation prices, which is the correct approach for Omnibus compliance.

The wc_price_history_simple_automatizuj_datume_snizenja() function uses WC_DateTime objects for timezone-safe date arithmetic, avoiding common PHP timezone pitfalls.

Excellent N+1 query prevention: the batch prefetch pattern for variation price history using a static $history_cache is well-implemented and shows performance awareness.

Request-level runtime cache ($runtime_cache static variable) in wc_price_history_simple_get_lowest_price() correctly prevents redundant database queries within a single page load.

Proper use of dbDelta() for table creation with composite indexes (product_id, date_gmt) optimized for the query patterns used.

Deactivation hook correctly uses wp_clear_scheduled_hook() to remove cron events without deleting user data.

Automatic 90-day data retention via cron is a good practice for EU Omnibus compliance and database hygiene.

AJAX delete endpoint correctly verifies both nonce and capability (manage_woocommerce) before performing destructive operations.

The $processed static array in wc_price_history_simple_on_save() correctly prevents duplicate processing when multiple hooks fire for the same product.

Proper use of gmdate() and current_time('mysql', true) for UTC-consistent database storage.

The shortcode correctly returns an empty hidden container for variable products, delegating display logic to JavaScript — this is an efficient pattern.

WooCommerce variation data filter (woocommerce_available_variation) is used correctly to pass server-computed price history to the frontend without additional AJAX calls.

The before_delete_post hook correctly cascades deletion to variation price history when a parent variable product is permanently deleted.

The WC_DateTime object usage in wc_price_history_simple_automatizuj_datume_snizenja() for timezone-safe date manipulation is the correct WooCommerce approach.

Uninstall.php correctly includes the WP_UNINSTALL_PLUGIN guard check.

The plugin correctly skips tracking prices for draft, auto-draft, and trash status products.

Admin script enqueue is correctly limited to product post type edit screens only.

Native <button> elements are correctly used for the delete action in the admin metabox, providing built-in keyboard accessibility (Enter/Space activation) without requiring additional ARIA or keydown handlers.

WordPress nonce fields are properly implemented for AJAX security, protecting admin actions.

The plugin correctly uses wp_nonce_field() with a named action, following WordPress security best practices.

The admin metabox uses WordPress native table classes (wp-list-table widefat fixed striped) which inherit WordPress admin accessibility styles.

Capability checks (current_user_can('manage_woocommerce')) are correctly applied before rendering delete controls, preventing unauthorized UI exposure.

The shortcode returns empty string for non-sale products, avoiding unnecessary DOM pollution.

The plugin correctly uses esc_html(), esc_attr(), and esc_html__() for output escaping throughout PHP templates.

The frontend JS correctly listens to WooCommerce native show_variation and hide_variation events rather than implementing custom variation detection, ensuring compatibility with WooCommerce's own accessibility handling.

The plugin avoids inline onclick handlers in PHP output, keeping behavior in separate JS files.

The admin script is conditionally enqueued only on product edit pages and only for authorized users, reducing unnecessary script loading.

Static runtime cache (static $runtime_cache, static $history_cache) correctly prevents N+1 queries within a single PHP request for variation price history lookups.

Batch prefetch of all variation price histories in a single IN() query avoids per-variation DB queries on product pages.

Composite database index KEY product_id_date_gmt (product_id, date_gmt) correctly covers all primary query patterns.

Frontend JavaScript is conditionally enqueued only on variable product pages via is_product() check.

Admin JavaScript is conditionally enqueued only on product edit pages with capability check (manage_woocommerce).

Daily cron cleanup prevents unbounded table growth by removing records older than 90 days.

Deactivation hook correctly clears the scheduled cron event.

AJAX endpoint has proper nonce verification and capability check before any DB operation.

Static $processed guard in wc_price_history_simple_on_save() prevents duplicate processing within a single request.

update_option() for db_version uses autoload=false, preventing unnecessary option loading on every page.

DB version check is correctly placed on admin_init (not init or plugins_loaded), avoiding frontend overhead.

Uninstall.php correctly cleans up the custom table, options, and transients on plugin removal.

wc_price_history_simple_apply_taxes() caches the tax_display option in a static variable to avoid repeated get_option() calls.