WPBakery Page Builder Addons by Livemesh Security & Risk Analysis

This plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices regarding SQL query sanitation, exclusively using prepared statements. It also shows an effort towards security with a reasonable number of nonce and capability checks. However, several significant concerns are present. The presence of two AJAX handlers without authentication checks presents a direct attack vector, allowing potential unauthorized actions. Furthermore, a substantial portion of output (36%) is not properly escaped, creating a significant risk of Cross-Site Scripting (XSS) vulnerabilities, especially given the plugin's history. The plugin's vulnerability history is a major red flag, with a total of five known CVEs, one of which remains unpatched. The consistent pattern of medium-severity XSS vulnerabilities suggests a recurring weakness in input sanitization or output encoding that has not been fully addressed. While the taint analysis shows no immediate critical or high-severity flows, the lack of such analysis (0 flows analyzed) is a limitation. The plugin's strengths in SQL handling are overshadowed by the persistent XSS issues and the unpatched vulnerability, leading to a moderate-to-high risk profile.