WS Form LITE – Drag & Drop Contact Form Builder Security & Risk Analysis

The "ws-form" plugin v1.10.80 presents a mixed security posture. While it demonstrates good practices in SQL query preparation (89%) and output escaping (98%), significant concerns arise from its attack surface. Specifically, two AJAX handlers lack authentication checks, creating potential entry points for unauthorized actions or data manipulation. The presence of the `unserialize` function is a notable risk, as it can lead to remote code execution if exposed to untrusted input.

The vulnerability history reveals a pattern of five medium-severity vulnerabilities, including missing authorization, cross-site scripting, SQL injection, and client-side enforcement issues. Although there are currently no unpatched CVEs, this history suggests a recurring tendency towards insecure handling of user input and permissions. The last vulnerability being relatively recent (April 2025) further underscores the need for vigilance. The absence of critical or high-severity vulnerabilities in the history and the lack of any high-severity taint flows are positive indicators, but the existing medium-severity issues and the unauthenticated AJAX handlers demand attention.

In conclusion, the plugin benefits from robust SQL and output sanitization. However, the unauthenticated AJAX endpoints and the potential risks associated with `unserialize` are significant weaknesses. The historical prevalence of medium-severity vulnerabilities, particularly those related to authorization and input sanitization, indicates areas where the plugin's security practices have been historically insufficient. A balanced approach would involve addressing the immediate risks from unauthenticated entry points and the `unserialize` function, while also considering the long-term implications of its past vulnerability trends.