WC Builder – WooCommerce Page Builder for WPBakery Security & Risk Analysis

The "wc-builder" plugin version 1.2.1 presents a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and having no known unpatched vulnerabilities. The presence of multiple capability checks across its AJAX handlers is also a strength. However, significant concerns arise from the attack surface analysis, particularly the four AJAX handlers that lack authentication checks. This directly exposes these entry points to potential abuse by unauthenticated users. While taint analysis shows no immediate exploitable flows, the presence of a dangerous `create_function` call, even if not directly exploited by current taint flows, is a code smell that could lead to vulnerabilities in the future. Furthermore, only 38% of output escaping is properly implemented, indicating a moderate risk of Cross-Site Scripting (XSS) vulnerabilities, a pattern corroborated by its vulnerability history which lists three medium severity XSS CVEs. The fact that the last vulnerability was recent (2025-12-27) and was of medium severity suggests ongoing issues with input sanitization and output escaping, despite the absence of unpatched vulnerabilities currently.

In conclusion, while the plugin avoids critical technical debt like unpatched CVEs or raw SQL queries, the significant number of unprotected AJAX handlers and the substantial percentage of improperly escaped output pose a moderate to high risk. The historical pattern of XSS vulnerabilities, coupled with the current lack of comprehensive output escaping, is the most concerning aspect. Developers should prioritize securing the AJAX endpoints and improving output escaping to mitigate these risks.