AVE – Elementor & Gutenberg Addons Security & Risk Analysis

The "advanced-visual-elements" plugin version 2.0.6 exhibits a mixed security posture. While it demonstrates some good practices, such as a high percentage of SQL queries using prepared statements and a significant number of capability checks, several critical concerns arise from the static analysis. The presence of unprotected AJAX handlers represents a substantial attack surface, directly exposing functionality to potential abuse without proper authorization. The use of the `unserialize` function is a significant red flag, as it can lead to remote code execution vulnerabilities if untrusted data is processed. Although no critical or high-severity taint flows were identified, the single flow with unsanitized paths warrants attention. The absence of any recorded vulnerability history might suggest a lack of past exploitation or diligent patching by developers, but it does not guarantee future security.