Store Locator WordPress Security & Risk Analysis

The agile-store-locator plugin v1.6.5 exhibits a mixed security posture. While the code signals indicate the absence of dangerous functions and a significant portion of SQL queries using prepared statements, there are considerable concerns regarding input sanitization and attack surface exposure. The static analysis reveals 2 out of 9 total entry points, including AJAX handlers, are not protected by authentication checks, posing a significant risk for unauthorized actions. Furthermore, the taint analysis highlights a concerning 41 flows with unsanitized paths, with 28 of them classified as High severity, directly indicating potential for serious vulnerabilities. The presence of 26 file operations without more context on their sanitization is also a potential area of concern.

The vulnerability history of this plugin is a significant red flag. With a total of 8 known CVEs, including 2 high-severity ones, and a recent vulnerability recorded in 2025, it indicates a recurring pattern of security weaknesses. The common vulnerability types, such as SQL Injection, Path Traversal, and Cross-Site Scripting, align with the concerns raised by the taint analysis and unprotected entry points. While there are currently no unpatched CVEs, the past history suggests a higher likelihood of future vulnerabilities if the underlying coding practices are not addressed. The plugin's reliance on the DataTables library also warrants attention, as outdated bundled libraries can introduce vulnerabilities if not kept up-to-date.

In conclusion, while the plugin demonstrates some good practices like utilizing prepared statements for SQL queries, the significant number of unsanitized taint flows, unprotected entry points, and a history of multiple high-severity vulnerabilities paint a picture of a plugin that requires immediate attention. The sheer volume of high-severity unsanitized flows and the lack of proper authorization on crucial entry points are the most critical immediate risks. The historical trend of vulnerabilities suggests ongoing security challenges that need to be proactively addressed to improve the plugin's overall security posture.