Boxzilla – WordPress Popup Builder Security & Risk Analysis

The Boxzilla plugin v3.4.7 presents a mixed security posture. On the positive side, it demonstrates good practices in its handling of SQL queries, utilizing prepared statements for all 11 queries. Furthermore, the plugin has no recorded vulnerabilities (CVEs), which is a strong indicator of past security diligence. However, the static analysis reveals several areas of concern. The presence of an unprotected AJAX handler represents a significant security risk, as it could be exploited without proper user authentication. While the plugin has a reasonable percentage of properly escaped outputs, a notable 28% remain unescaped, which could lead to Cross-Site Scripting (XSS) vulnerabilities if malicious data is processed. The taint analysis indicates two flows with unsanitized paths, though thankfully these did not reach critical or high severity levels in this analysis. The complete absence of nonce checks on any entry points is also a deficiency. The plugin's strengths lie in its SQL security and lack of past vulnerabilities, but the unprotected AJAX handler and output escaping issues are areas that require immediate attention to strengthen its overall security.