Notifal – AI Popup Builder & CRO Engine: Sales Notifications, Social Proof & Exit Intent Popups Security & Risk Analysis

The "notifal" v2.1.0 plugin exhibits a mixed security posture. On the positive side, it has no recorded CVEs and a history free of known vulnerabilities, suggesting a generally stable codebase. The plugin also shows good practices in its use of prepared statements for SQL queries (88%) and proper output escaping (84%), along with a reasonable number of nonce and capability checks. However, a significant concern is the large attack surface exposed without adequate authentication or permission checks. A substantial 45 out of 57 entry points, including a high number of AJAX handlers and REST API routes, lack these critical security measures. While no critical taint flows were identified, the presence of unsanitized paths in 6 out of 14 analyzed flows, combined with the large number of unprotected entry points, presents a substantial risk of potential unauthorized access or code execution vulnerabilities. The single use of `preg_replace` with the `/e` modifier is also a critical red flag, as this function is deprecated due to its potential for arbitrary code execution when used with user-supplied input.