UltraAddons for Elementor Security & Risk Analysis

The "ultraaddons-elementor-lite" v2.0.2 plugin exhibits a mixed security posture. While the static analysis shows good practices like 100% prepared SQL statements and a high percentage of properly escaped output, several concerning areas exist. The presence of 3 shortcodes as entry points, even without immediate unprotected access, represents potential vectors for exploitation if not handled carefully within their logic. The static analysis also indicates file operations and external HTTP requests, which can introduce vulnerabilities if inputs influencing these operations are not rigorously sanitized. Furthermore, the plugin has a history of 5 known CVEs, with 3 remaining unpatched, all of medium severity. These include common and serious vulnerabilities like Cross-site Scripting (XSS), Cross-Site Request Forgery (CSRF), and Authorization Bypass. The recency of the last vulnerability (2025-05-16) suggests ongoing security issues. While the current version's static analysis highlights some positive security implementations, the historical prevalence and unpatched nature of past vulnerabilities significantly elevate the risk, suggesting a pattern of recurring security weaknesses that require careful attention and prompt patching.