Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Security & Risk Analysis

The blog-designer-pack plugin exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query sanitization and output escaping, several concerning aspects are present. The static analysis reveals a notable attack surface with 15 entry points, two of which lack authentication checks. Furthermore, taint analysis indicates two high-severity flows with unsanitized paths, suggesting potential vulnerabilities in how user-supplied data is handled. The plugin's vulnerability history is a significant concern, with three known CVEs, including one critical and one high-severity vulnerability. The fact that the last vulnerability was in April 2025 and is currently unpatched is a critical red flag. While the plugin has strengths in its widespread use of prepared statements and a high percentage of escaped outputs, the presence of critical historical vulnerabilities and identified high-severity taint flows, coupled with unprotected AJAX handlers, warrants caution. The historical pattern of Remote File Inclusion and Cross-site Scripting vulnerabilities suggests recurring issues with input validation and file handling that need robust and ongoing attention.