Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers Security & Risk Analysis

The "popup-builder-block" plugin v2.2.4 presents a mixed security profile. On the positive side, the static analysis reveals strong adherence to secure coding practices in several areas. All identified SQL queries utilize prepared statements, indicating a good defense against SQL injection. The vast majority of output is properly escaped, mitigating cross-site scripting (XSS) risks. Furthermore, the plugin incorporates nonce and capability checks, and its attack surface appears to be well-protected by authorization mechanisms.

However, significant concerns arise from the plugin's historical vulnerability record. With seven known CVEs, including one currently unpatched, and a recent vulnerability discovered in 2026, this indicates a pattern of security flaws. The types of past vulnerabilities, such as missing authorization, information exposure, SSRF, and SQL injection, are serious and suggest underlying architectural weaknesses or ongoing maintenance issues. The presence of an unpatched vulnerability is particularly alarming, as it leaves users exposed to known exploits.

In conclusion, while the current static analysis shows some good security implementations, the plugin's past strongly suggests a need for caution. The unpatched vulnerability is a critical immediate risk. The recurring nature of high-severity vulnerability types in its history points to potential systemic issues that may not be fully captured by a single static analysis run. Users should prioritize updating to a version that addresses all known vulnerabilities, especially the unpatched one.