Popup Box – Create Countdown, Coupon, Video, Contact Form Popups Security & Risk Analysis

The 'ays-popup-box' plugin, version 6.1.9, presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of SQL queries using prepared statements and a significant number of capability checks, it also exhibits several concerning weaknesses. The attack surface is substantial, with 22 AJAX handlers, and alarmingly, 21 of these lack authentication checks, creating numerous potential entry points for unauthorized actions. Furthermore, the taint analysis reveals 4 high-severity flows, indicating potential risks related to improper input handling that could lead to security vulnerabilities. The plugin's historical vulnerability record is also a significant red flag, with 17 known CVEs, including a recent one in 2026. The prevalence of Cross-Site Request Forgery, Missing Authorization, Cross-Site Scripting, and SQL Injection in past vulnerabilities suggests recurring security flaws that need to be addressed.

Despite the presence of some security measures, the high number of unprotected AJAX endpoints and the critical taint analysis findings are significant risks. The historical data also points to a pattern of common and severe vulnerability types, suggesting that fundamental security issues may persist. While the plugin has a large number of outputs and a good percentage are escaped, the 4 high-severity taint flows are a more immediate concern. The plugin's overall security is compromised by these factors, necessitating careful consideration of its use or prompt mitigation of the identified risks.