Borderless – Addons and Templates for Elementor Security & Risk Analysis

The "borderless" plugin v1.7.5 exhibits a concerning security posture despite some positive aspects. While it utilizes prepared statements for SQL queries and has a high percentage of properly escaped outputs, the significant number of AJAX handlers without authentication checks presents a substantial attack surface. The presence of dangerous functions like `unserialize` and unsanitized paths in taint analysis further elevates the risk, particularly as these could be leveraged in conjunction with the unprotected entry points. The plugin's history of 8 known CVEs, with a notable number of medium severity vulnerabilities including XSS, Code Injection, and Missing Authorization, indicates a recurring pattern of security weaknesses that have historically required patching. The recent vulnerability in 2025 suggests ongoing issues, even though there are currently no unpatched CVEs. The combination of a large unprotected attack surface, potentially dangerous code patterns, and a history of exploitable vulnerabilities points to a plugin that requires careful monitoring and potentially a riskier approach to deployment.