Qi Addons For Elementor Security & Risk Analysis

The "qi-addons-for-elementor" plugin version 1.9.6 presents a mixed security posture. On the positive side, static analysis reveals no critical or high-severity taint flows, all SQL queries are properly prepared, and there are a reasonable number of nonce and capability checks for its entry points. However, a significant concern is the 31% of outputs that are not properly escaped, indicating a risk of Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not handled carefully in these instances.

The plugin's vulnerability history is a significant red flag. With 10 known CVEs, including 2 high-severity ones, and a recent vulnerability discovered in August 2025, it suggests a pattern of security flaws. The recurring types of vulnerabilities like exposure of sensitive information, remote file inclusion, and XSS, coupled with the sheer number of past issues, indicate a need for diligent patching and ongoing security review by the developers.

While the current version shows improvements in some areas like SQL sanitation and a lack of critical taint flows, the historical context and the observed output escaping issues warrant caution. Users should remain vigilant about applying updates promptly, as the plugin has a history of vulnerabilities. The presence of file operations and external HTTP requests, while not flagged as problematic in this analysis, could become attack vectors if not secured properly in conjunction with other potential weaknesses.