Popups for Divi Security & Risk Analysis

The "popups-for-divi" v3.2.6 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong output escaping practices, with 96% of outputs properly handled, and has no recorded critical or high-severity vulnerabilities in its history, suggesting a generally stable codebase. The absence of dangerous functions, file operations, and critical taint flows is also encouraging. However, significant concerns arise from its attack surface. Three out of four AJAX handlers lack authentication checks, representing a substantial risk. Furthermore, the single SQL query present is not using prepared statements, which could lead to SQL injection vulnerabilities if not handled with extreme care. The presence of bundled library DataTables, while common, could introduce risks if it's outdated and unpatched, though no specific version information is provided to assess this.

While the plugin's vulnerability history is clean, this does not negate the risks identified in the static analysis. The unprotected AJAX endpoints are a primary concern, as they can be exploited by unauthenticated users to trigger potentially harmful actions. The lack of prepared statements for SQL queries is another critical weakness. Given the clean vulnerability history, it's possible these issues have not been exploited in the past, but they represent latent risks that a motivated attacker could leverage. The plugin has strengths in output escaping and a lack of severe historical issues, but the unprotected entry points and raw SQL query demand immediate attention.