Rotating Words For WPBakery Page Builder Security & Risk Analysis

The plugin "rotating-words-for-visual-composer" v3.0 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by avoiding dangerous functions, file operations, and external HTTP requests. All SQL queries are correctly prepared, and there are no known CVEs associated with this plugin, suggesting a relatively stable history. The attack surface is limited to a single shortcode, with no AJAX handlers or REST API routes, and crucially, no unprotected entry points identified.

However, significant concerns arise from the lack of output escaping. With 100% of its outputs not being properly escaped, this opens the door to Cross-Site Scripting (XSS) vulnerabilities. While taint analysis did not reveal any specific unsanitized flows, the absence of proper escaping means that any data processed by the plugin and then displayed to users could be maliciously manipulated. The complete absence of nonce checks and capability checks is also a notable weakness, even with a small attack surface. This could allow unauthorized users to trigger shortcode functionalities if specific conditions are met, though the lack of identified AJAX/REST vulnerabilities mitigates this immediate risk.