Ibtana – WordPress Website Builder Security & Risk Analysis

The "ibtana-visual-editor" plugin v1.2.5.7 presents a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and properly escaping almost all output. The absence of dangerous functions and bundled libraries is also a strength. However, the plugin has a significant attack surface with 29 entry points, of which 6 are unprotected, including AJAX handlers and REST API routes that lack proper authorization checks. This indicates a potential for unauthorized actions and privilege escalation.

The taint analysis, while limited, did reveal one flow with unsanitized paths, which could lead to path traversal vulnerabilities. The plugin's vulnerability history is a major concern, with a total of 7 known CVEs, one of which remains unpatched. The common vulnerability types, Cross-site Scripting and Missing Authorization, directly align with the findings from the static analysis, particularly the unprotected AJAX handlers and REST API routes. The recency of the last vulnerability (September 2025) suggests ongoing security issues.

In conclusion, while the plugin has some fundamental security strengths in its data handling, the substantial number of unprotected entry points and the history of critical vulnerabilities, especially missing authorization, create a considerable risk. The unpatched CVE is a direct and pressing threat that requires immediate attention. Mitigation efforts should focus on securing all entry points and addressing the historical vulnerability patterns.