GeoVerse Maps – Google Maps Block for WordPress Security & Risk Analysis

The 'advanced-google-map-block' plugin v1.3.2 exhibits a generally positive security posture, primarily due to the absence of known vulnerabilities and a clean vulnerability history. The static analysis indicates a limited attack surface with no AJAX handlers, REST API routes, shortcodes, or cron events exposed, and all of these, if present, would have been protected by authentication. Furthermore, the plugin avoids dangerous functions and all identified SQL queries utilize prepared statements, which is a strong security practice.

However, a significant concern arises from the output escaping. With one total output identified and 0% properly escaped, this presents a notable risk of Cross-Site Scripting (XSS) vulnerabilities. Any user-supplied data that is rendered on the frontend without proper sanitization could be exploited. While taint analysis shows no flows, this does not negate the risk posed by unescaped output, as the taint analysis might not cover all potential scenarios or inputs.

In conclusion, the plugin's lack of historical vulnerabilities and minimal attack surface are strengths. The primary weakness is the unescaped output, which requires immediate attention. Addressing this issue would significantly improve the plugin's overall security.