Lightbox Pop – Responsive Lightbox Security & Risk Analysis

The "lightbox-pop" v2.3.3 plugin exhibits a mixed security posture. While the plugin has no recorded vulnerability history, indicating a potentially well-maintained or less targeted codebase, the static analysis reveals several areas of concern. A significant weakness lies in its attack surface, with two of its five entry points (AJAX handlers) lacking proper authentication checks. This could allow unauthorized users to trigger plugin functionalities. Furthermore, the complete absence of prepared statements for its SQL queries is a critical vulnerability, potentially exposing the plugin to SQL injection attacks. The low percentage of properly escaped output (17%) also suggests a high risk of cross-site scripting (XSS) vulnerabilities, as user-supplied data is likely being rendered directly into the page without sufficient sanitization.