Findings
Plugin appears fine except for a publicly exploitable XSS in js/window.php. Advisory created.
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:
XSS in js/window.php