Visual Composer Website Builder Security & Risk Analysis

The static analysis for Visual Composer v45.15.0 reveals a generally positive security posture regarding its attack surface. There are no reported AJAX handlers, REST API routes, shortcodes, or cron events with unprotected entry points. The plugin also demonstrates good practices with a high percentage of SQL queries using prepared statements and a significant portion of outputs being properly escaped. Nonce and capability checks are present, and there are no bundled libraries to indicate potential outdated dependencies.

However, the taint analysis indicates a potential concern. While there are no critical or high-severity flows with unsanitized paths, the presence of two flows with unsanitized paths warrants attention. This suggests that user-supplied input might not be adequately validated before being used in certain operations, potentially leading to vulnerabilities if not handled carefully in the context of where these flows occur. The file operations and external HTTP requests, while not directly flagged as risky in the static analysis, represent areas that would require deeper manual review to ensure no insecure handling.

The vulnerability history shows a significant number of past medium-severity CVEs, primarily related to Cross-Site Scripting (XSS). While there are currently no unpatched vulnerabilities, the historical pattern of XSS issues indicates a recurring weakness that has required multiple fixes. The last vulnerability being in August 2025, while in the future, might be a placeholder or indicative of a recent historical fix that occurred around that time. The overall picture is a plugin that has improved its security hygiene significantly but has a past prone to XSS, and a minor lingering concern from the taint analysis regarding input sanitization.