WP Tactical Popup Security & Risk Analysis

The wp-tactical-popup plugin version 1.1 presents a significant security risk due to several critical findings in its static analysis. A primary concern is the presence of two AJAX handlers that lack authentication checks, creating an easily exploitable attack surface. Furthermore, the plugin uses the dangerous `unserialize` function four times, which is a known vector for remote code execution if user-controlled data is not properly sanitized before being serialized and unserialized. The complete lack of output escaping for all 23 identified output points is a glaring vulnerability, making cross-site scripting (XSS) attacks highly probable.

The vulnerability history indicates a concerning pattern. The plugin has a known CVE, which is currently unpatched and classified as medium severity. This, combined with the common vulnerability type being Cross-site Scripting, reinforces the static analysis findings regarding the lack of output escaping and suggests that previous security issues have not been adequately addressed. While the plugin doesn't appear to have critical taint flows or raw SQL issues without prepared statements, the combination of unprotected entry points, the dangerous use of `unserialize`, and pervasive output escaping failures, alongside a history of unpatched XSS vulnerabilities, paints a picture of a plugin that requires immediate attention.