Dominion – Domain Checker for WPBakery Security & Risk Analysis

The plugin "dominion-domain-checker-wpbakery-addon" v2.3.1 demonstrates a generally good security posture with several positive indicators. It boasts a clean code signal report, featuring no dangerous functions, all SQL queries utilizing prepared statements, and no file operations or external HTTP requests. The presence of nonce and capability checks, along with a reasonable percentage of properly escaped output, further contribute to its strength.

However, a significant concern arises from its vulnerability history. The plugin has a known medium-severity Cross-Site Scripting (XSS) vulnerability that remains unpatched. The fact that the last recorded vulnerability was in 2025 suggests that the plugin might be actively maintained, but the unpatched nature of this specific XSS issue presents a clear and present danger. While the static analysis found no immediate critical or high severity issues, the historical context of an unpatched XSS vulnerability is a strong red flag that cannot be ignored.

In conclusion, while the code itself appears to follow many secure coding practices, the existence of an unpatched medium-severity XSS vulnerability significantly degrades the overall security assessment. Users should be highly cautious and prioritize applying the relevant patch as soon as it becomes available. The plugin shows potential for good security, but this single unpatched vulnerability is a critical weakness.