Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Security & Risk Analysis

The post-grid-carousel-ultimate plugin version 1.7 shows a mixed security posture. On the positive side, the static analysis reveals a low number of unprotected entry points, with all AJAX handlers, REST API routes, and shortcodes appearing to have authorization checks. The plugin also utilizes prepared statements for all SQL queries and has a high percentage of properly escaped output, indicating good practices in these areas. However, the presence of the `unserialize` function without explicit taint analysis results is a significant concern, as deserialization vulnerabilities can be severe. The historical vulnerability data paints a worrying picture, with 7 known CVEs, including 4 high and 3 medium severity issues. The common vulnerability types like Remote File Inclusion, Path Traversal, Cross-site Scripting, and Deserialization of Untrusted Data suggest recurring weaknesses that attackers have exploited in the past. The fact that the last vulnerability was in early 2025 and none are currently unpatched is a positive sign for this specific version, but the history indicates a pattern of past security flaws that demand vigilance.