HT Mega – Absolute Addons for WPBakery Page Builder Security & Risk Analysis

The ht-mega-for-wpbakery plugin v1.1.0 exhibits a mixed security posture. On the positive side, all SQL queries utilize prepared statements, a significant portion of output is properly escaped, and there are no identified untainted flows or file operations. The plugin also has a reasonable number of entry points with a zero-count for unprotected ones, which is good. However, several concerning signals are present. The use of the 'create_function' is a notable risk, as this function is deprecated and can be a vector for code injection if used improperly. The absence of nonce checks across all entry points is a significant weakness, potentially allowing for Cross-Site Request Forgery (CSRF) attacks. The limited number of capability checks further exacerbates this risk, as it implies that actions might be performed without proper authorization.

The vulnerability history indicates a pattern of Cross-site Scripting (XSS) vulnerabilities, with two medium-severity CVEs recorded. While currently unpatched vulnerabilities are zero, the recurring nature of XSS suggests that input sanitization and output escaping practices, while generally good, may have overlooked specific edge cases. The last recorded vulnerability in 2025 suggests that the provided data might be future-dated or a placeholder, which complicates a precise assessment of current risk. Overall, the plugin has some strong security fundamentals in place, particularly regarding SQL and output handling, but the lack of nonce checks and the presence of 'create_function' represent critical areas for immediate improvement to mitigate potential XSS and CSRF risks.