News Element Elementor Blog Magazine Security & Risk Analysis

The "news-element" v1.0.9 plugin exhibits a concerning security posture, primarily due to its significant attack surface composed of numerous AJAX handlers, a substantial portion of which lack proper authentication checks. While the plugin demonstrates some good practices, such as the majority of its SQL queries utilizing prepared statements and a reasonable number of nonce and capability checks, these are overshadowed by critical vulnerabilities and risky code patterns. The presence of the `unserialize` function without apparent sanitization is a significant red flag, especially considering the taint analysis revealed flows with unsanitized paths, although thankfully none reached a critical or high severity in the static analysis.

The plugin's vulnerability history is particularly alarming, with 3 known CVEs, 2 of which remain unpatched. The types of past vulnerabilities, including Missing Authorization, Cross-site Scripting, and PHP Remote File Inclusion, indicate a recurring pattern of weaknesses that attackers can exploit. The fact that a critical CVE exists and is unpatched suggests a high immediate risk to sites using this plugin. The last vulnerability being relatively recent, despite the version being 1.0.9, also raises questions about ongoing maintenance and responsiveness to security issues.

In conclusion, while the plugin shows some positive security implementations, the combination of a large, unprotected attack surface, the use of dangerous functions like `unserialize`, and a history of critical and unpatched vulnerabilities makes "news-element" v1.0.9 a high-risk plugin. Users should exercise extreme caution and prioritize updating or finding alternatives.