Zion Builder – Website Builder for Speed & Creativity Security & Risk Analysis

The ZionBuilder plugin v3.6.17 exhibits a generally good security posture, with several positive indicators. The complete absence of SQL injection vulnerabilities due to 100% prepared statement usage is a significant strength. Furthermore, the presence of nonce and capability checks across its entry points, along with a lack of dangerous function usage, suggests a development team that is aware of common WordPress security practices.

However, there are areas for improvement. The static analysis reveals that 23% of output is not properly escaped, which could potentially lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is displayed without adequate sanitization. While the taint analysis shows no critical or high-severity flows, the presence of two unsanitized path flows warrants attention, as these can sometimes be exploited in conjunction with other vulnerabilities or misconfigurations.

The vulnerability history indicates two medium-severity CVEs, both related to XSS. While none are currently unpatched, this pattern suggests that XSS remains a recurring concern for this plugin. The most recent vulnerability was in December 2024, indicating that past security issues, though resolved, have been present. Overall, ZionBuilder has a solid foundation, but the unescaped output and historical XSS trends highlight areas where developers should focus their security efforts to further harden the plugin.