Hustle – Email Marketing, Lead Generation, Optins, Popups Security & Risk Analysis

The 'wordpress-popup' plugin v7.8.10.2 exhibits a concerning security posture, despite some positive indications in static analysis. While the vast majority of SQL queries are prepared and output escaping is generally strong, the plugin presents a significant attack surface with 40 unprotected AJAX handlers. This is a major weakness that could allow unauthenticated users to trigger potentially malicious actions. The taint analysis revealed one flow with unsanitized paths, which, although not rated as critical or high, still warrants attention as it indicates a potential avenue for injection vulnerabilities.

The vulnerability history is a significant red flag. With a total of 8 known CVEs, including 3 high and 5 medium severity vulnerabilities, and the last one being in 2026, it suggests a recurring pattern of security flaws. The types of past vulnerabilities, such as exposure of sensitive information, unrestricted file uploads, missing authorization, XSS, and injection, directly correlate with the uncovered attack surface and taint flow issues. This historical data strongly suggests a history of poor security practices or insufficient remediation.

In conclusion, while the plugin demonstrates good practices in SQL preparation and output escaping, the large number of unprotected AJAX endpoints, a detected unsanitized path flow, and a history of severe vulnerabilities significantly outweigh these strengths. The plugin should be considered a high-risk component until these critical issues are addressed and a sustained period of vulnerability-free updates is observed. The lack of currently unpatched CVEs is a positive sign, but the historical pattern and present static analysis findings demand caution.