Web and WooCommerce Addons for WPBakery Builder Security & Risk Analysis

The "vc-addons-by-bit14" plugin version 1.5 exhibits a mixed security posture. On the positive side, the static analysis indicates strong adherence to secure coding practices, with 100% of SQL queries using prepared statements and all identified outputs being properly escaped. Furthermore, all 27 entry points, including AJAX handlers and shortcodes, appear to have authorization checks, and there are no identified flows with unsanitized paths, critical or high severity taint issues.

However, significant concerns arise from the plugin's vulnerability history. With four known CVEs, and crucially, two of them remaining unpatched, this indicates a recurring pattern of security weaknesses. The prevalence of medium severity vulnerabilities, specifically Cross-site Scripting (XSS) and Missing Authorization, in the past suggests that these types of flaws are being introduced or are not being effectively remediated. The fact that the last vulnerability was reported as recently as December 31, 2025, despite the static analysis showing good practices, is particularly concerning and suggests potential blind spots or a delay in addressing discovered issues.

In conclusion, while the current version's code analysis suggests good secure coding practices, the plugin's history of unpatched vulnerabilities is a major red flag. The presence of known, unpatched vulnerabilities outweighs the positive static analysis findings, making this plugin a moderate to high risk. Users should exercise caution and prioritize applying any available patches for older versions, although the data implies a history of delayed patching.