Popups – WordPress Popup Security & Risk Analysis

The "conversion-popup" plugin v1.4.66 exhibits a mixed security posture. On the positive side, there are no reported CVEs, no direct SQL queries to worry about as they are all prepared, and no apparent file operations or external HTTP requests that could be exploited. The absence of critical or high-severity taint flows is also a good indicator. However, a significant concern is the complete lack of output escaping, meaning all 10 identified output points are potentially vulnerable to Cross-Site Scripting (XSS) attacks. Additionally, the plugin has zero nonce checks and only one capability check, which is insufficient for protecting its entry points, even though the static analysis reports zero unprotected entry points. This suggests a potential blind spot in the analysis or that the entry points might be indirect and not captured by the current analysis.

The vulnerability history is clean, which is encouraging, but it doesn't negate the immediate risks identified in the static analysis. The combination of a completely unescaped output and limited authorization checks on entry points presents a tangible risk. While the plugin appears to have a small attack surface based on the static analysis, the lack of proper output sanitization leaves it susceptible to XSS, which can lead to session hijacking, credential theft, or defacement. The limited capability checks further compound this risk.