Zigaform – Form Builder Lite Security & Risk Analysis

The zigaform-form-builder-lite plugin version 7.6.9 presents a mixed security posture. While it demonstrates good practices by utilizing prepared statements for the majority of its SQL queries and incorporates a substantial number of nonce and capability checks, several areas raise significant concerns. The static analysis reveals a large attack surface with 7 AJAX handlers lacking authentication checks, which can be a direct entry point for attackers. Furthermore, the taint analysis highlights 21 high-severity flows with unsanitized paths, indicating a strong potential for various injection vulnerabilities, most notably cross-site scripting as suggested by the vulnerability history. The plugin's history of 2 medium-severity CVEs, both related to cross-site scripting, reinforces the risk posed by inadequate input sanitization. Although there are no currently unpatched CVEs and a majority of SQL queries are prepared, the identified untrusted paths and unprotected AJAX endpoints are critical weaknesses that warrant immediate attention. The plugin's reliance on bundled libraries like DataTables, jQuery, and TinyMCE also introduces a potential risk if these libraries are not kept up-to-date within the plugin itself, although the provided data does not explicitly detail their versions or associated vulnerabilities.