| #1 | All In One Lightbox – show any media in beautiful popups | 100 | | 0 | 3k+ | | | No open findings |
| #2 | Popup for Elementor | 100 | | 2 | 800 | | | Non-prefixed function |
| #3 | Advanced Popups | 99 | 4 | 0 | 60k+ | | | wp function not compatible with requires wp |
| #4 | Light Modal Block | 99 | 1 | 1 | 2k+ | | | Missing direct file access protection |
| #5 | Promolayer – Popup Builder & Abandonment Preventer | 99 | 2 | 0 | 1k+ | | | Non Enqueued Script |
| #6 | MakeITeasy Popup | 99 | 3 | 0 | 1k+ | | | Missing direct file access protection |
| #7 | Nelio Popups | 99 | 5 | 0 | 900 | | | Missing direct file access protection |
| #8 | Fastest Age Verification | 99 | 1 | 0 | 500 | | | outdated tested upto header |
| #9 | WPC Added To Cart Notification for WooCommerce | 98 | | 17 | 3k+ | | | Non-prefixed class |
| #10 | Alligator Popup | 98 | 2 | 1 | 2k+ | | | outdated tested upto header |
| #11 | Content Blocks Builder – Create blocks, repeater blocks with carousel, grid, popup layouts | 98 | | 38 | 1k+ | | | Non-prefixed hook name |
| #12 | Popup Block | 98 | 6 | 2 | 700 | | | Missing direct file access protection |
| #13 | Really Simple Popup | 98 | 2 | 4 | 400 | | | Missing Version |
| #14 | Easy Lightbox – Image, Gallery and Video Lightbox for WordPress | 97 | 2 | 5 | 1k+ | | | trademarked term |
| #15 | Gutena Video Lightbox | 97 | 7 | 2 | 1k+ | | | Missing Arg Domain |
| #16 | Modal Builder Block | 97 | 4 | 2 | 700 | | | Missing direct file access protection |
| #17 | Modal Popup Box — Popup Maker & Popup Builder | 96 | 1 | 3 | 2k+ | | | Input is not sanitized |
| #18 | Wikipedia Preview | 96 | 8 | 15 | 1k+ | | | Non-prefixed function |
| #19 | WPBean Form Popup for WPForms and Contact Form 7 – Create Popup Forms Easily | 94 | | 22 | 600 | | | Direct Query |
| #20 | Zotabox – 20+ Promotional Sales tools to boost your subscribers and sales | 94 | 12 | 8 | 500 | | | wp function not compatible with requires wp |
| #21 | OffCanvas / Drawer – add sleek slide-in panels to any page | 92 | 6 | 2 | 900 | | | Missing direct file access protection |
| #22 | Popups for Divi | 89 | 99 | 57 | 100k+ | | | Text Domain Mismatch |
| #23 | Alligator Menu Popup | 87 | 4 | 1 | 600 | | | Missing Arg Domain |
| #24 | Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers | 84 | 1 | 73 | 70k+ | | | Direct Query |
| #25 | Popupsmart | 79 | 28 | 2 | 600 | | | Output is not escaped |
| #26 | Claspo – Popups, Spin the Wheel & Email Capture | 78 | 107 | 16 | 1k+ | | | wp function not compatible with requires wp |
| #27 | RS Template Builder For Elementor – Complete Control Over Headers, Footers & More | 76 | 14 | 56 | 2k+ | | | Post Not In exclude |
| #28 | Simple Image Popup | 73 | 21 | 5 | 1k+ | | | Output is not escaped |
| #29 | Popup for Contact Form 7 | 73 | 13 | 7 | 800 | | | Setting is missing a sanitization callback |
| #30 | WP IE Buster | 71 | 13 | 3 | 700 | | | Output is not escaped |
| #31 | Gist All-In-One Marketing – Live Chat, Popups, Email | 69 | 24 | 11 | 500 | | | Output is not escaped |
| #32 | Smartarget – Chat Buttons & Engagement Apps | 68 | 31 | 11 | 1k+ | | | Non Singular String Literal Domain |
| #33 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | 66 | 45 | 689 | 700k+ | | | Non-prefixed hook name |
| #34 | PopBox For Elementor | 66 | 31 | 9 | 3k+ | | | Output is not escaped |
| #35 | WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation | 66 | 8 | 89 | 1k+ | | | Non-prefixed global variable |
| #36 | ARI Fancy Lightbox – Popup for WordPress | 62 | 8 | 107 | 10k+ | | | Non-prefixed namespace |
| #37 | WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click | 60 | 22 | 9 | 6k+ | | | Output is not escaped |
| #38 | iConvert Promoter | 57 | 98 | 217 | 2k+ | | | Non-prefixed global variable |
| #39 | Easy GDPR Consent Forms – MailChimp | 57 | 72 | 22 | 500 | | | Text Domain Mismatch |
| #40 | Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More | 55 | 50 | 63 | 7k+ | | | Text Domain Mismatch |
| #41 | Age Gate Lite | 52 | 28 | 3 | 2k+ | | | Output is not escaped |
| #42 | Cart Popup for WooCommerce | 51 | 9 | 115 | 9k+ | | | Non-prefixed global variable |
| #43 | Convertful – Your Ultimate On-Site Conversion Tool | 48 | 15 | 34 | 3k+ | | | wp function not compatible with requires wp |
| #44 | Simple Popup Plugin | 47 | 53 | 5 | 1k+ | | | Output is not escaped |
| #45 | Popup Box – Easily Create WordPress Popups | 45 | 7 | 151 | 6k+ | | | Non-prefixed global variable |
| #46 | Floating Awesome Button (Sticky Button, Popup, Toast) & 200+ Website Custom Interactive Element | 43 | 66 | 109 | 800 | | | Missing direct file access protection |
| #47 | Modal Window – create popup modal window | 40 | 4 | 170 | 10k+ | | | Non-prefixed global variable |
| #48 | Popup addon for Ninja Forms | 40 | 121 | 25 | 900 | | | Output is not escaped |
| #49 | I Agree! Popups | 40 | 54 | 46 | 500 | | | Output is not escaped |
| #50 | WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups | 38 | 299 | 58 | 3k+ | | | Non Singular String Literal Domain |