Split Test For Elementor Security & Risk Analysis

The "split-test-for-elementor" plugin v1.8.4 exhibits several significant security concerns, indicating a weak overall security posture. The static analysis reveals a substantial attack surface with 3 out of 3 REST API routes lacking permission callbacks, making them unprotected entry points. Furthermore, only 14% of output is properly escaped, suggesting a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. Taint analysis highlights 3 high-severity flows with unsanitized paths, which could be exploited for various attacks.

The plugin's vulnerability history is also troubling. With 3 known CVEs, and 2 of them currently unpatched, this indicates a recurring pattern of security flaws. The types of past vulnerabilities, including SQL Injection, XSS, and CSRF, align with some of the risks identified in the static analysis. While the plugin has some strengths, such as the absence of dangerous functions and file operations, the prevalent lack of authentication on entry points, poor output escaping, and unpatched historical vulnerabilities outweigh these positive aspects.