Popup and Widget Builder: Lead Capture, Exit Intent, Forms, Quizzes, Gamification Security & Risk Analysis

The "poper" plugin v1.0.14 demonstrates several positive security practices, including the complete absence of dangerous functions, all SQL queries utilizing prepared statements, and proper output escaping for all identified outputs. Furthermore, there is no recorded history of vulnerabilities, which suggests a commitment to security or a lack of prior exploitation. The plugin also avoids file operations and external HTTP requests, further reducing potential attack vectors. However, a significant concern arises from the presence of four unprotected AJAX handlers, which represent a considerable attack surface with no authentication or capability checks. While the taint analysis shows no critical or high-severity flows, the lack of checks on these entry points could still allow for potential misuse if malicious data were to be passed. The presence of one nonce check and one capability check is positive but insufficient given the number of unprotected AJAX endpoints.