AMP Designs for Elementor by LevelUP Security & Risk Analysis

The 'levelup' v1.1 plugin presents a mixed security posture. On the positive side, it demonstrates good practices in its SQL query handling, exclusively using prepared statements, and avoids critical vulnerabilities indicated by taint analysis. The absence of any recorded CVEs, historical or current, suggests a generally stable codebase. However, there are significant concerns regarding its attack surface, particularly the presence of three unprotected AJAX handlers. While the plugin implements nonce and capability checks, the unprotected entry points represent a direct avenue for potential unauthorized actions if exploited. The moderate rate of properly escaped output (45%) also introduces a risk of cross-site scripting (XSS) vulnerabilities, although the severity of these is not explicitly detailed in the provided data.

Overall, the plugin has strengths in its data handling and lack of critical security flaws. The primary weaknesses lie in the exposure of AJAX functionality without proper authentication or authorization, and the potential for XSS due to insufficient output escaping. While the vulnerability history is clean, the static analysis reveals actionable risks that require attention to prevent future security incidents. A balanced approach to improving security would involve addressing the unprotected AJAX handlers and increasing the rate of output escaping.