UiCore Elements – Free widgets and templates for Elementor Security & Risk Analysis

The uicore-elements plugin version 1.3.14 exhibits a mixed security posture. While it demonstrates good practices such as 100% prepared SQL statements and a high percentage of output escaping (80%), significant concerns arise from its attack surface and vulnerability history. The static analysis reveals 4 REST API routes, with 2 lacking proper permission callbacks, creating potential unauthorized access vectors. Additionally, the absence of nonce checks across all entry points, particularly concerning given the unprotected REST API endpoints, is a notable weakness. The vulnerability history is concerning, with 3 past CVEs, including one high and two medium severity vulnerabilities, primarily related to Cross-site Scripting and Missing Authorization. The fact that these historical issues often involved authorization problems further emphasizes the risk posed by the unprotected REST API endpoints found in this version. While the current static analysis doesn't show exploitable flows or missing capability checks on all identified entry points, the historical pattern and the presence of unprotected REST API routes suggest a recurring tendency towards authorization and input sanitization issues.