Innovs WPBakery Visual Composer WHMCS Elements Security & Risk Analysis

The "void-visual-whmcs-element" plugin v1.0.4.3 exhibits a mixed security posture. While it demonstrates good practices in avoiding dangerous functions and using prepared statements for SQL queries, significant concerns arise from its attack surface and historical vulnerability patterns. Three out of four identified entry points, specifically AJAX handlers, lack proper authentication checks. This is further compounded by taint analysis revealing two flows with unsanitized paths, suggesting a potential for injecting malicious data into the application, though thankfully no critical or high-severity issues were flagged in this analysis. The plugin's history of three known CVEs, with two currently unpatched and all being medium severity and related to Cross-Site Scripting, is a major red flag. This pattern indicates a recurring weakness in how user input is handled, making it susceptible to persistent or stored XSS attacks.