Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages Security & Risk Analysis

The 'page-builder-add' v1.5.3.4 plugin presents a mixed security posture. On the positive side, it demonstrates good practices by implementing nonce checks on all AJAX handlers and utilizes prepared statements for all SQL queries. The absence of unprotected REST API routes and cron events is also commendable. However, the presence of two `unserialize` functions is a significant concern, as it can lead to object injection vulnerabilities if not handled with extreme care. The taint analysis, while showing no critical or high severity flows, did identify 9 flows with unsanitized paths, indicating potential areas where user-supplied input could be misused, even if not immediately exploitable as a critical vulnerability.

The plugin's vulnerability history is a major red flag. With 8 known CVEs, one of which is currently unpatched and rated as high severity, the plugin has a history of significant security flaws. The common vulnerability types (RFI, XSS, Open Redirect) suggest recurring issues with input validation and file handling. The recent high-severity vulnerability from 2026 is particularly alarming, implying ongoing security challenges. Despite the good practices in some areas, the substantial number of past vulnerabilities and the presence of an unpatched high-severity CVE outweigh the positive aspects, demanding caution.