Void Elementor Post Grid Addon for Elementor Page builder Security & Risk Analysis

The "void-elementor-post-grid-addon-for-elementor-page-builder" plugin, version 2.4, exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by exclusively using prepared statements for SQL queries and properly escaping a high percentage of its output. It also incorporates nonce and capability checks for its entry points, contributing to a more secure foundation. However, a significant concern arises from the presence of the `unserialize` function without clear evidence of sanitization. While taint analysis did not reveal any immediate unsanitized flows, the inherent risks associated with unserializing untrusted data remain. Furthermore, the plugin's vulnerability history is troubling, with two known CVEs, including a high-severity "PHP Remote File Inclusion" and "Missing Authorization" vulnerability. The fact that the last vulnerability was recently discovered (August 2024) and the high-severity one remains unpatched in the history indicates a recurring pattern of exploitable weaknesses. Despite its strengths in output escaping and prepared statements, the historical prevalence of critical vulnerabilities and the presence of `unserialize` pose substantial risks.