Instant Popup Builder – Powerful Popup Maker for Opt-ins, Email Newsletters & Lead Generation Security & Risk Analysis

The "instant-popup-builder" plugin v1.1.8 exhibits a generally positive security posture with strong adherence to best practices in SQL query preparation and output escaping. The vast majority of SQL queries utilize prepared statements, and nearly all output is properly escaped, significantly reducing the risk of common web vulnerabilities like SQL injection and Cross-Site Scripting (XSS). The absence of known CVEs and common vulnerability types in its history further suggests a commitment to maintaining a secure codebase. However, the presence of 9 AJAX handlers without authentication checks represents a significant concern. While no critical taint flows were identified, 14 high-severity flows with unsanitized paths indicate potential weaknesses that could be exploited if an attacker can interact with these unprotected AJAX endpoints. The large number of AJAX handlers overall contributes to a considerable attack surface, and the unprotected subset amplifies this risk.