Popup addon for Ninja Forms Security & Risk Analysis

The 'popup-addon-for-ninja-forms' plugin v3.5.2 presents a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and implementing nonce and capability checks on some entry points, significant concerns remain regarding output escaping and historical vulnerabilities. The static analysis reveals that a substantial portion of output (55%) is not properly escaped, indicating a potential risk of Cross-Site Scripting (XSS) vulnerabilities. Despite the absence of critical or high severity taint flows in this analysis, the history of two medium severity XSS vulnerabilities, with the last occurring in late 2025, suggests a recurring pattern of input sanitization issues. The lack of unpatched CVEs is positive, but the ongoing presence of medium severity issues in the past warrants attention. The plugin has a small attack surface with only one shortcode, and it appears to be protected. However, the unescaped output is the most prominent risk, and the historical trend of XSS vulnerabilities, even if currently patched, suggests a need for more robust input validation and output sanitization.