Visual Builder Security & Risk Analysis

The "visual-builder" v1.9 plugin demonstrates a mixed security posture, with several strong practices but notable areas of concern. The plugin benefits from an absence of dangerous functions, proper SQL prepared statements, and a high percentage of properly escaped output. Furthermore, the extensive use of nonce and capability checks indicates a deliberate effort to secure its functionalities. However, the presence of two AJAX handlers without authentication checks represents a significant risk, as these could be exploited by unauthenticated users. The taint analysis, while not revealing critical or high severity issues, did identify flows with unsanitized paths, which warrants further investigation to ensure no zero-day vulnerabilities exist.

The plugin's vulnerability history is a point of caution. While there are no currently unpatched CVEs, the single known medium severity vulnerability, specifically related to missing authorization, aligns with the identified unprotected AJAX handlers. This pattern suggests a recurring weakness in authorization enforcement. The last recorded vulnerability in May 2025 also implies a recent history of security flaws. In conclusion, "visual-builder" v1.9 has commendable security features but is hampered by critical authorization flaws in its attack surface and a history that reinforces these concerns.