FormDesigner – online web form builder Security & Risk Analysis

The formdesigner plugin v2.2.0 exhibits a mixed security posture. On the positive side, the absence of any known CVEs and the use of prepared statements for all SQL queries are strong indicators of good development practices. The plugin also avoids bundling external libraries and making excessive external HTTP requests, which reduces potential attack vectors.

However, significant security concerns arise from the static analysis. The plugin has a relatively large attack surface with 4 total entry points, and a concerning 3 of these are completely unprotected by authentication checks. Furthermore, only 15% of its output is properly escaped, suggesting a high likelihood of cross-site scripting (XSS) vulnerabilities. The lack of nonce checks on AJAX handlers is another critical weakness, as it can allow unauthorized users to trigger plugin functionalities.

Given the lack of historical vulnerabilities, it might suggest that the plugin's existing protections have been sufficient up to this point. However, the current code analysis reveals several fundamental security oversights that expose the plugin and its users to significant risk, particularly from XSS and unauthorized action execution.