WP Popups – WordPress Popup builder Security & Risk Analysis

The "wp-popups-lite" plugin v2.2.0.7 presents a mixed security posture. While it demonstrates good practices such as a significant number of nonce checks and capability checks, and a lack of dangerous functions or bundled libraries, there are notable areas of concern. The static analysis reveals a considerable attack surface with 5 AJAX handlers lacking authentication checks, which is a direct entry point for potential unauthorized actions. Furthermore, the taint analysis indicates 7 flows with unsanitized paths, suggesting a risk of vulnerabilities if these paths are not properly handled, even though no critical or high severity issues were flagged in this specific analysis. The plugin's vulnerability history is a significant red flag, with a history of 6 medium severity CVEs, including missing authorization and cross-site scripting. Although there are no currently unpatched CVEs, the recurrence of these vulnerability types indicates a persistent weakness in input validation and authorization enforcement within the plugin's development or maintenance lifecycle. This suggests a potential for similar vulnerabilities to emerge if development practices do not improve.