Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce Security & Risk Analysis

The "coupon-x-discount-pop-up" plugin v1.4.5 exhibits a mixed security posture. While it demonstrates good practices in areas like prepared SQL statements and output escaping, significant concerns remain. The presence of 15 AJAX handlers, with one lacking authentication checks, presents a direct and potentially exploitable attack vector. The use of the `unserialize` function, especially without explicit context on its data source, is a red flag for deserialization vulnerabilities.

Taint analysis shows no critical or high severity unsanitized paths, which is a positive indicator. However, the plugin's vulnerability history is concerning, with two known CVEs, including a high and a medium severity vulnerability. The common vulnerability types of "Deserialization of Untrusted Data" and "Missing Authorization" align directly with the potential risks identified in the static analysis. The fact that the last vulnerability was in early 2025 suggests a pattern of past security weaknesses that require diligent monitoring.

In conclusion, while the plugin incorporates some robust security measures, the unprotected AJAX handler and the historical recurrence of authorization and deserialization issues necessitate a cautious approach. The plugin's strengths lie in its generally good SQL and output sanitization, but these are overshadowed by the potential for privilege escalation or arbitrary code execution through the identified entry points and past vulnerabilities.