Easy Popup Maker Security & Risk Analysis

The "easy-popup-maker" v1.4 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and having a high percentage of properly escaped output. There's no recorded vulnerability history, which suggests a relatively stable and secure past.

However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers without any authentication checks, creating a considerable attack surface. Additionally, the taint analysis indicates two flows with unsanitized paths, and while no critical or high severity issues were identified in taint analysis, the presence of unsanitized paths is a potential entry point for malicious input. The lack of nonce checks on the AJAX handlers further exacerbates this risk.

In conclusion, while the plugin avoids common pitfalls like raw SQL injection and significant output escaping issues, the unprotected AJAX endpoints and unsanitized path flows are critical weaknesses. These present a notable risk that requires immediate attention, overshadowing the positive aspects of its SQL and output handling.