Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages Security & Risk Analysis

The "unlimited-elementor-inner-sections-by-boomdevs" plugin v1.2.0 presents a mixed security posture. While it demonstrates good practices in terms of output escaping (96%) and largely utilizes prepared statements for SQL queries (80%), there are significant concerns regarding its attack surface. Specifically, 5 out of 10 AJAX handlers lack authentication checks, creating potential entry points for unauthorized actions. The taint analysis shows 2 flows with unsanitized paths, although they did not reach critical or high severity, they still represent a risk. The plugin's vulnerability history is also noteworthy; it has 2 known medium severity CVEs, with the last one being recent (April 2024), indicating a pattern of past security issues, particularly around missing authorization. Although there are no currently unpatched vulnerabilities, this history suggests a need for vigilant patching and code review. In conclusion, while the plugin has strengths in data handling, the presence of unprotected AJAX endpoints and past vulnerabilities warrants caution and proactive security management.