Visual Composer Galleria Security & Risk Analysis

The plugin "vc-galleria" v1.1.1 exhibits a mixed security posture. On the positive side, the static analysis reveals no dangerous functions, no direct SQL queries (all are prepared), no file operations, and no external HTTP requests. The absence of known CVEs and any recorded vulnerability history is also a strong indicator of a well-maintained or less complex plugin.

However, significant concerns arise from the lack of output escaping. With 100% of outputs not properly escaped, this presents a high risk of Cross-Site Scripting (XSS) vulnerabilities. If any user-supplied data or dynamically generated content is outputted without sanitization, an attacker could inject malicious scripts. Furthermore, the complete absence of nonce and capability checks on the identified entry point (shortcode) is a critical oversight, potentially allowing unauthorized actions or information disclosure if the shortcode's functionality is sensitive or can be manipulated.

In conclusion, while the plugin avoids common pitfalls like raw SQL and external requests, the unescaped output and the lack of robust authorization checks on its shortcode represent substantial security weaknesses that need immediate attention. The clean vulnerability history is a positive sign, but it doesn't negate the risks identified in the current analysis.