Builderius – Landing Page Builder + Dynamic Templates Security & Risk Analysis

The static analysis of Builderius v1.3.1-beta reveals a mixed security posture. On one hand, the plugin exhibits strong defenses against direct attack vectors by having zero identified AJAX handlers, REST API routes, shortcodes, or cron events that are exposed or unprotected. This indicates a conscious effort to limit the plugin's attack surface. However, the code analysis also flags 25 instances of dangerous functions, including `unserialize` and `assert`. While the taint analysis found no critical or high-severity flows with unsanitized paths, the presence of `unserialize` is a significant concern, as it can lead to Remote Code Execution (RCE) if untrusted data is unserialized. Furthermore, only 74% of output escaping is properly done, leaving room for Cross-Site Scripting (XSS) vulnerabilities. The lack of any recorded vulnerabilities in its history is a positive sign, suggesting a potentially stable codebase or infrequent public exposure. Nevertheless, the identified dangerous functions and less-than-perfect output escaping warrant attention.