Icegram Engage – Popups, Optins, CTAs & Lead Generation Security & Risk Analysis

The "icegram" plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices in SQL query handling with a high percentage of prepared statements and a robust number of nonce and capability checks. The majority of output is properly escaped, and it has no currently unpatched CVEs, which is a significant strength. However, there are several areas of concern. The presence of 14 AJAX handlers, with 3 lacking authentication checks, creates a notable attack surface for unauthorized actions. Furthermore, the use of the dangerous `unserialize` function, even if not directly linked to a critical taint flow in this analysis, always presents a risk of arbitrary code execution if attacker-controlled data is passed to it. The vulnerability history reveals a significant number of past medium and high severity issues, including missing authorization and CSRF. While the plugin has a recent security patch (implied by the 2026 date, though this seems like a future date and might be a typo), the sheer volume of past vulnerabilities suggests a history of security oversights. The taint analysis shows no critical or high severity flows, which is reassuring, but the two flows with unsanitized paths warrant attention, as they could lead to vulnerabilities if exploited under certain conditions. The presence of bundled libraries like Select2 also introduces a dependency risk if those libraries are outdated or have known vulnerabilities.

In conclusion, while "icegram" v3.1.39 has made strides in secure coding practices, particularly with prepared statements and output escaping, its past vulnerability record and the identified weaknesses in its attack surface (unauthenticated AJAX handlers, `unserialize` function) prevent it from being considered highly secure. The plugin requires ongoing vigilance and a commitment to addressing identified vulnerabilities promptly. Users should be aware of the potential risks associated with unauthenticated entry points and the inherent dangers of deserialization functions.