Modal Window – create popup modal window Security & Risk Analysis

The 'modal-window' plugin v6.2.4 exhibits a mixed security posture. While it demonstrates strong practices in output escaping (98%) and makes good use of prepared statements for SQL queries (77%), several concerns warrant attention. The presence of a dangerous function (`preg_replace(/e)`) is a significant red flag, as this can be a common vector for remote code execution if not handled with extreme care. Furthermore, the taint analysis reveals three high-severity flows with unsanitized paths, indicating potential for data leakage or manipulation if these paths are exploited. The plugin's history of 7 CVEs, including one high-severity vulnerability type (Cross-Site Scripting) and others related to CSRF, suggests a past tendency towards input validation and authorization weaknesses, though it's positive that there are currently no unpatched CVEs.