PowerPack Lite for Beaver Builder Security & Risk Analysis

The static analysis of PowerPack Addon for Beaver Builder v1.3.1 presents a mixed security picture. On one hand, the absence of unprotected AJAX handlers, REST API routes, shortcodes, and cron events suggests a limited direct attack surface. The code also demonstrates good practices in using prepared statements for all SQL queries and includes nonce checks and capability checks, indicating an awareness of common WordPress security measures. However, a significant concern arises from the low percentage of properly escaped output (12%), which, coupled with taint analysis revealing flows with unsanitized paths, points to a high risk of Cross-Site Scripting (XSS) vulnerabilities. The presence of file operations and external HTTP requests, while not inherently insecure, warrants careful review in conjunction with the output escaping issues.

The plugin's vulnerability history is a major red flag. With 5 known CVEs, including 1 high and 4 medium severity issues, and a recent vulnerability recorded in December 2024, the plugin has a consistent track record of security flaws. The common vulnerability types, namely Cross-site Scripting and PHP Remote File Inclusion, are precisely the types of issues that stem from poor input handling and unsanitized paths, aligning with the static analysis findings. The fact that all previously identified CVEs are currently patched is a positive sign, but the pattern of past vulnerabilities suggests a need for heightened vigilance and thorough code reviews for any future updates.

In conclusion, while PowerPack Addon for Beaver Builder v1.3.1 has some strengths in its minimal direct attack surface and use of prepared statements, the pervasive lack of output escaping and the historical pattern of XSS and RFI vulnerabilities create a significant risk. The taint analysis confirming unsanitized paths exacerbates these concerns. Users should be aware of the potential for XSS and the need for careful review of any updates, as the plugin has demonstrated a tendency towards these types of issues.