WPZOOM Addons for Elementor – Starter Templates & Widgets Security & Risk Analysis

The wpzoom-elementor-addons plugin exhibits a mixed security posture. While it demonstrates strong adherence to secure coding practices by utilizing prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. A substantial number of AJAX handlers (10 out of 14) lack proper authentication checks, presenting a clear entry point for unauthorized actions. The taint analysis, while not revealing critical or high-severity issues in the current version, has identified flows with unsanitized paths, indicating a potential for path traversal or other input-related vulnerabilities if not handled rigorously. The plugin's historical vulnerability record is troubling, with a significant number of past CVEs, including a critical one, and a recent history of medium-severity issues across various common vulnerability types like XSS and path traversal. Although there are currently no unpatched vulnerabilities, this history suggests a recurring pattern of security weaknesses that require ongoing vigilance. The presence of the Select2 library, while potentially useful, also introduces a dependency that could be a vector for vulnerabilities if it's an outdated or unpatched version.