Marvy – Background Animations for Elementor Security & Risk Analysis

The "marvy-animation-addons-for-elementor-lite" plugin version 1.7.5 presents a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no known historical vulnerabilities, suggesting a generally well-maintained codebase. However, a significant concern arises from its attack surface, specifically the presence of two unprotected AJAX handlers. These handlers represent direct entry points into the plugin's functionality that do not enforce any authentication or authorization checks, leaving them susceptible to unauthorized access and potential exploitation.

While static analysis did not reveal critical vulnerabilities like dangerous functions, unsanitized taint flows, or raw SQL queries, the lack of authentication on the AJAX handlers is a notable weakness. The plugin also has a moderate rate of properly escaped outputs (69%), which could, in a more complex scenario, lead to cross-site scripting (XSS) vulnerabilities if untrusted data were to reach these unescaped outputs. The absence of a vulnerability history is a strength, indicating past diligence, but it does not negate the immediate risks identified in the current code analysis.