EleSpare – News, Magazine and Blog Addons for Elementor Security & Risk Analysis

The "elespare" plugin v3.3.10 exhibits a mixed security posture. On one hand, the static analysis reveals positive practices such as 100% use of prepared statements for SQL queries, a high rate of proper output escaping (97%), and robust use of nonce and capability checks. However, there are significant concerns regarding the attack surface. Specifically, 2 out of 6 entry points, consisting of REST API routes, lack permission callbacks, making them potentially accessible to unauthorized users. The taint analysis shows no unsanitized paths, which is a strong positive indicator. The vulnerability history reveals a pattern of past vulnerabilities, including Cross-site Scripting and Missing Authorization, with two medium-severity CVEs historically. While currently unpatched vulnerabilities are zero, the past incidents, especially those related to authorization, align with the observed unprotected REST API routes, highlighting a persistent area of risk that needs careful monitoring and remediation.

Despite the absence of critical findings in the current static and taint analysis and the lack of currently unpatched vulnerabilities, the presence of unprotected REST API endpoints is a direct security concern. This, coupled with the historical pattern of authorization and XSS vulnerabilities, suggests that the plugin, while improving, has had past weaknesses in input validation and access control. The overall security is decent due to good SQL and output handling, but the unprotected entry points represent a clear and present risk. The bundled Freemius library, while version 1.0, is not flagged as outdated by the provided data, but should be a consideration for future checks if more detailed information were available. The conclusion is that the plugin is generally well-coded but has specific, exploitable weaknesses in its access control mechanisms for its REST API.