Vertex Addons for Elementor Security & Risk Analysis

This plugin, 'addons-for-elementor-builder' v1.6.4, exhibits a generally strong security posture with good practices in several key areas. The majority of SQL queries are properly prepared, and a high percentage of output is escaped, significantly reducing the risk of common web vulnerabilities. The plugin also demonstrates a commitment to security by implementing a substantial number of nonce and capability checks for its entry points. However, there are a few areas that warrant attention. The presence of the `unserialize` function is a known risk, as it can be a vector for deserialization vulnerabilities if not handled with extreme care, especially when dealing with user-supplied data. Additionally, one REST API route lacks a permission callback, creating an unprotected entry point that could be exploited. The vulnerability history indicates a past medium-severity cross-site scripting vulnerability, suggesting that while the current version might be patched, the code has had historical issues with input sanitization.