Author Popup Security & Risk Analysis
wordpress.org/plugins/author-popupA CSS popup will appear by hovering on an author link with user profile & social links.
Is Author Popup Safe to Use in 2026?
Generally Safe
Score 85/100Author Popup has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.
The "author-popup" v1.0 plugin presents a seemingly strong security posture based on the provided static analysis. It boasts zero AJAX handlers, REST API routes, shortcodes, or cron events, indicating a very small attack surface with no identified entry points. Furthermore, the code analysis reveals no dangerous functions, no file operations, no external HTTP requests, and critically, all SQL queries utilize prepared statements. The absence of vulnerability history, including CVEs, is also a positive indicator, suggesting a history of security awareness or fortunate circumstances.
However, a significant concern arises from the complete lack of output escaping. With 3 total outputs and 0% properly escaped, this plugin is highly vulnerable to Cross-Site Scripting (XSS) attacks. Any data processed or displayed by the plugin without proper sanitization can be injected by an attacker, potentially leading to session hijacking, credential theft, or defacement. The absence of nonce and capability checks further exacerbates this risk, as it implies that these potentially vulnerable outputs might be accessible without proper user authentication or authorization.
Key Concerns
- Unescaped output detected
- Missing nonce checks
- Missing capability checks
Author Popup Security Vulnerabilities
Author Popup Code Analysis
Output Escaping
Author Popup Attack Surface
WordPress Hooks 2
Maintenance & Trust
Author Popup Maintenance & Trust
Maintenance Signals
Community Trust
Author Popup Alternatives
Edit Author Slug
edit-author-slug
Allows an admin (or capable user) to edit the author slug of a user, and change the author base.
WP Meta and Date Remover
wp-meta-and-date-remover
Remove meta author and date information from posts and pages. Hide from Humans and Search engines.SEO friendly and most advance plugin.
Simple Author Box
simple-author-box
Add a responsive author box or guest author box with social icons to any post. Great author box for any site!
Co-Authors Plus
co-authors-plus
Assign multiple bylines to posts, pages, and custom post types with a search-as-you-type input box.
Hide/Remove Metadata
hide-metadata
Hide/Remove Metadata is a free WordPress plugin that helps you hide author and published date either by CSS or PHP from your website effortlessly.
Author Popup Developer Profile
2 plugins · 20 total installs
How We Detect Author Popup
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/author-popup/img/twitter.png/wp-content/plugins/author-popup/img/facebook.png/wp-content/plugins/author-popup/img/youtube.png/wp-content/plugins/author-popup/img/starburst.gif/wp-content/plugins/author-popup/javascript/ap.jsauthor-popup/javascript/ap.js?ver=author-popup/css/ap_style.css?ver=HTML / DOM Fingerprints
bubbleInfotriggerpopuppopup-contents<!--
jQuery.noConflict();
jQuery(function () {
jQuery('.bubbleInfo').each(function () {
var distance = 1;
var time = 250;
var hideDelay = 500;
var hideDelayTimer = null;
var beingShown = false;
var shown = false;
var trigger = jQuery('.trigger', this);
var info = jQuery('.popup', this).css('opacity', 0);
jQuery([trigger.get(0), info.get(0)]).mouseover(function () {
if (hideDelayTimer) clearTimeout(hideDelayTimer);
if (beingShown || shown) {
// don't trigger the animation again
return;
} else {
// reset position of info box
beingShown = true;
info.css({
top: -58,
right: -50,
display: 'block'
}).animate({
top: '-=' + distance + 'px',
opacity: 1
}, time, 'swing', function() {
beingShown = false;
shown = true;
});
}
return false;
}).mouseout(function () {
if (hideDelayTimer) clearTimeout(hideDelayTimer);
hideDelayTimer = setTimeout(function () {
hideDelayTimer = null;
info.animate({
top: '-=' + distance + 'px',
opacity: 0
}, time, 'swing', function () {
shown = false;
info.css('display', 'none');
});
}, hideDelay);
return false;
});
});
});
//-->id="dpop"class="popup"id="topleft"class="corner"id="topright"class="corner"+13 morejQuery