WP HealthKit's independent audit rates EngagePop overall risk as CRITICAL with a report-card grade of D.

How many vulnerabilities does EngagePop have?

The audit found 120 findings: 2 critical, 17 high, 36 medium severity.

Should I use EngagePop?

Based on the latest audit (grade D, risk CRITICAL), review the 120 findings on this page before deciding — higher-risk findings should be weighed against the plugin's alternatives.

EngagePop

Audited at release

v1.3.0WordPress PluginAudited 9 days ago

Build popups, slide-ins and announcement bars inside WordPress. Free, unlimited, no account. Optional EngagePop account adds web push.

CRITICAL

Total Findings

120

Security Grade

Security Findings

120

Critical2

High17

Medium36

Low20

Info45

Executive Summary

Is EngagePop secure? In WP HealthKit's independent 2026 audit, EngagePop received an overall risk of CRITICAL and a report-card grade of D across 120 findings (2 critical, 17 high severity).

Directory audit — deterministic scanners only (Wordfence, OSV, PHPCS, PHPStan, Semgrep, Psalm, compat). Sign in and run a full audit for AI-grade analysis (security, quality, accessibility).

Security Report Card

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.4Mismatch detected

Categories with Findings

SecurityPHP CompatibilityDatabasePlugin LifecycleCoding StandardsPHP CompatibilityType SafetyWooCommerce CompatibilityHook WiringAccessibilityTheme StandardsWordPress CompatibilityPlugin ConflictsPerformancecompatibilityDependencies

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

[![EngagePop security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/engagepop)](https://wphealthkit.com/directory/engagepop)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Site owners: should they update?

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

PHP Compatibility

Requires PHP 8.0Declared minimum: 7.4Mismatch detected

EngagePop

Security Findings

Executive Summary

Security Report Card

PHP Compatibility

Categories with Findings

Plugin Info

Embed

Are you the developer?

Audit Your Plugin

PHP Compatibility

Categories with Findings