WPEForm Lite – Drag and Drop Live Form Builder for Contact, Payment & Quiz Forms Security & Risk Analysis

The "wpeform-lite" plugin v1.6.5 demonstrates a generally good security posture, with no known CVEs and a significant majority of SQL queries using prepared statements. The absence of exposed AJAX handlers, REST API routes, shortcodes, and cron events without authentication significantly reduces its attack surface. However, the static analysis reveals several areas for concern that could introduce vulnerabilities. The most notable is the extremely low rate of proper output escaping (5%), indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is displayed without adequate sanitization. Additionally, the presence of a single file operation without further context is a potential risk, especially if it involves user input or handles sensitive files. The taint analysis did flag one flow with an unsanitized path, which, while not classified as critical or high severity, still warrants attention as it represents a potential avenue for file system traversal or other path-related attacks.

While the plugin has no recorded vulnerability history, this does not guarantee future security. The identified weaknesses, particularly the output escaping and the single unsanitized path flow, are common entry points for attackers. The lack of nonce and capability checks on any of the identified entry points (although there are none exposed directly) is a theoretical concern that could become relevant if new entry points are added in future versions. The bundled Freemius and TinyMCE libraries are also potential risks if they are outdated or contain known vulnerabilities, though no specific version issues are highlighted in the provided data. In conclusion, "wpeform-lite" v1.6.5 is not overtly vulnerable based on known history and the absence of critical code signals. However, the poor output escaping and the unsanitized path flow represent significant, actionable risks that should be addressed to improve its overall security.