JVH Gridbuilder WPBakery VC Element Security & Risk Analysis

The plugin "jvh-gridbuilder-wpbakery-vc-element" v2.8.0 exhibits a mixed security posture. On the positive side, it has a relatively small attack surface with no unprotected entry points detected via AJAX or REST API. The absence of known CVEs and recorded vulnerabilities suggests a history of good security practices or a lack of exploitation. However, several concerning code signals raise red flags.

The presence of a dangerous `unserialize` function, coupled with two SQL queries that are not using prepared statements, introduces potential risks. A significant portion of output (67%) is not properly escaped, which could lead to Cross-Site Scripting (XSS) vulnerabilities if user-controlled data is involved in these outputs. The complete lack of nonce checks and capability checks on its entry points is a serious oversight, potentially allowing unauthorized actions. The bundled Select2 library, if outdated, could also introduce known vulnerabilities.

While the plugin has no recorded vulnerability history, the identified code signals, particularly the unescaped outputs and lack of authorization checks, indicate areas that require immediate attention to prevent future security incidents. A proactive approach to address these code-level weaknesses is recommended.