BS Maps – Google Map and Leaflet Map for Elementor and WPBackery Security & Risk Analysis

The plugin "bs-maps-google-map-and-leaflet-map-for-elementor-and-wpbakery" version 1.2.0 exhibits a generally positive security posture due to its reliance on prepared statements for SQL queries and high rate of output escaping. The absence of any recorded vulnerabilities or CVEs further suggests a history of responsible development and patching. However, a significant concern arises from the presence of an unprotected AJAX handler, which represents a direct entry point into the application that lacks authentication. This could potentially be exploited if an attacker can trigger this handler without proper authorization, leading to unintended actions or information disclosure, depending on the handler's functionality. While the taint analysis shows no critical or high severity flows, the single unprotected AJAX endpoint warrants careful consideration and immediate attention to mitigate potential risks.