VPSUForm – Drag & Drop Contact Form Builder with Email Automation Security & Risk Analysis

The "v-form" plugin exhibits a mixed security posture. While it employs prepared statements for a majority of its SQL queries and includes a reasonable number of nonce checks, significant concerns arise from its attack surface and input sanitization practices. The presence of 17 unprotected entry points (AJAX handlers and REST API routes) is a critical weakness, exposing the plugin to unauthorized access and potential exploitation. Furthermore, the taint analysis revealing 6 high-severity flows with unsanitized paths indicates a high likelihood of vulnerabilities like Cross-Site Scripting (XSS) or other injection flaws if these flows are exposed externally.

The plugin's vulnerability history, with 7 known CVEs including one high and six medium severity, reinforces these concerns. The common types of vulnerabilities identified (Exposure of Sensitive Information, Missing Authorization, XSS) directly align with the risks highlighted in the static and taint analysis. The fact that the last vulnerability was in late 2025 might suggest a history of security issues. Despite the positive aspects like the use of PHPMailer (though its version isn't specified for potential outdatedness) and a good percentage of escaped outputs, the identified unprotected entry points and high-severity taint flows present a substantial risk.

In conclusion, "v-form" v3.2.31 has several concerning security practices, primarily related to its exposed attack surface and input sanitization. While some good security habits are present, they are overshadowed by the potential for exploitation through unprotected AJAX handlers and REST API routes, and the high-severity taint flows. Users should exercise extreme caution or consider alternative plugins until these critical issues are addressed.