Advanced Image Hover Effect for Elementor Security & Risk Analysis

The "advanced-image-hover-effect-for-elementor" plugin, version 1.11.21, exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and has a clean vulnerability history with no recorded CVEs. This suggests a commitment to secure coding and maintenance.

However, a significant concern arises from the static analysis, which reveals one unprotected AJAX handler. This represents a direct entry point into the plugin's functionality that could be exploited by unauthenticated users. While the taint analysis shows no critical or high severity flows and dangerous functions are absent, the unprotected AJAX handler remains a notable risk that could potentially lead to unauthorized actions or information disclosure depending on its implementation. The presence of capability checks and proper output escaping for the majority of outputs are strengths, but the single unprotected entry point is a critical weakness.

In conclusion, while the plugin benefits from a lack of past vulnerabilities and secure SQL handling, the unprotected AJAX endpoint poses an immediate and exploitable risk. Addressing this single unprotected entry point should be a high priority to significantly improve the plugin's overall security.