Brave Popup Builder – Popup, Optins, Lead Generation, Survey & Interactive Content Security & Risk Analysis

The static analysis of brave-popup-builder v0.8.5 presents a seemingly strong security posture with zero identified attack surface points, dangerous functions, or unsanitized taint flows. The code also demonstrates good practices by exclusively using prepared statements for SQL queries and properly escaping all output. File operations and external HTTP requests are also absent, further reducing potential risks.

However, this positive static analysis is overshadowed by a concerning vulnerability history. The plugin has a total of 5 known CVEs, with 1 high and 4 medium severity vulnerabilities. The types of past vulnerabilities, including Missing Authorization, CSRF, XSS, and SSRF, indicate a pattern of significant security weaknesses in previous versions. While there are currently no unpatched vulnerabilities, the presence of these past issues and the recency of the last reported vulnerability (December 2025) suggest a history of security flaws that require vigilance. The absence of any identified issues in the current version's static analysis might be misleading given the plugin's track record. Therefore, a proactive approach to security updates and ongoing monitoring is strongly recommended.