ElementInvader Addons for Elementor Security & Risk Analysis

The "elementinvader-addons-for-elementor" plugin v1.4.3 exhibits a mixed security posture. While the static analysis indicates a relatively small attack surface with no unprotected entry points (AJAX, REST API, shortcodes, cron), and a good rate of output escaping (87%), there are concerning indicators within the code signals and vulnerability history. The presence of SQL queries without prepared statements, external HTTP requests, and only two nonce checks suggest areas where vulnerabilities could be introduced if input is not handled rigorously. The taint analysis revealing two flows with unsanitized paths, even without critical or high severity, is a significant concern pointing to potential injection vulnerabilities.

The plugin's vulnerability history is a major red flag, with a total of 14 known CVEs. The fact that none are currently unpatched is positive, but the historical prevalence of medium and high severity vulnerabilities, including missing authorization, PHP remote file inclusion, authorization bypass, information exposure, and cross-site scripting, indicates a pattern of past security weaknesses. The types of past vulnerabilities strongly suggest that input validation and authorization checks have been insufficient in previous versions. The last recorded vulnerability in February 2026, while in the future, suggests a potential for ongoing research and disclosure related to this plugin.

In conclusion, while v1.4.3 appears to have addressed some immediate risks by implementing authentication checks on entry points and a high percentage of output escaping, the underlying code quality and historical vulnerability patterns warrant caution. The identified taint flows with unsanitized paths and the past security issues necessitate a thorough review and potentially further hardening of the code. Users should be aware of the plugin's history and ensure they are always using the latest available version, while developers should prioritize robust input sanitization and authorization.