Lead Form Builder & Contact Form Security & Risk Analysis

The plugin "lead-form-builder" v2.1.0 exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation (88%) and output escaping (87%), and implements a reasonable number of nonce and capability checks, there are significant areas of concern. The presence of two unprotected AJAX handlers creates an immediate attack vector for unauthorized actions. The taint analysis reveals a high number of flows with unsanitized paths (13 out of 21 analyzed), including nine with high severity, suggesting potential for serious vulnerabilities like code injection or cross-site scripting if these flows are triggered by user input. The use of the `unserialize` function, flagged as a dangerous function, is another red flag, as it can lead to remote code execution if not handled with extreme caution and proper input validation.

The plugin's vulnerability history is a major concern, with ten known CVEs, including two high-severity vulnerabilities. While none are currently unpatched in this specific version, the recurring types of vulnerabilities (Exposure of Sensitive Information, Code Injection, CSRF, Missing Authorization, XSS) indicate a pattern of security weaknesses that have historically been exploited. The fact that the last vulnerability was dated in the future (2026-03-10) is likely an anomaly in the data provided and should be disregarded in a real-world assessment. Overall, while the plugin has some strengths in secure coding practices, the combination of unprotected entry points, critical taint flows, dangerous function usage, and a history of diverse, high-severity vulnerabilities points to a moderately high risk that requires careful attention and remediation.