Zigaform – Price Calculator & Cost Estimation Form Builder Lite Security & Risk Analysis

The "zigaform-calculator-cost-estimation-form-builder-lite" v7.6.9 plugin presents a mixed security posture. While it demonstrates some good practices, such as a significant percentage of SQL queries using prepared statements and a substantial number of nonce checks, there are notable areas of concern. The presence of 7 AJAX handlers without authentication checks represents a significant direct attack surface, potentially allowing unauthorized actions. Furthermore, the taint analysis reveals 22 high-severity flows with unsanitized paths, indicating a strong possibility of vulnerabilities like Cross-Site Scripting (XSS) or Local File Inclusion (LFI) if user-supplied data is not properly handled before being used in sensitive operations. The vulnerability history, though currently showing no unpatched CVEs, points to a past pattern of "Exposure of Sensitive Information to an Unauthorized Actor" and "Cross-site Scripting," suggesting that these types of vulnerabilities have been present in the past and may re-emerge if code quality degrades. The plugin also utilizes bundled libraries that could be a vector if they contain known vulnerabilities, though their versioning is not provided.