Maps by BestWebSoft Security & Risk Analysis

The bws-google-maps plugin v1.4.4 exhibits a generally strong security posture, primarily due to a high percentage of properly escaped output and a robust implementation of nonce and capability checks. The static analysis reveals no critical or high-severity taint flows, indicating that user-supplied input is being handled with reasonable care. The absence of unprotected entry points is also a positive sign.

However, the plugin is not entirely without concern. While the current version has no unpatched vulnerabilities, its history includes one medium severity Cross-Site Scripting (XSS) vulnerability from 2017. This suggests a past susceptibility to input manipulation that could lead to code execution or sensitive data exposure. The presence of SQL queries that are not consistently using prepared statements (50% not prepared) presents a potential risk for SQL injection, although the extent of this risk depends on the nature of the queries and the data they handle. The plugin also makes external HTTP requests, which could be a vector for various attacks if not handled securely.

In conclusion, bws-google-maps v1.4.4 demonstrates good security practices with strong output escaping and authentication mechanisms. The past XSS vulnerability serves as a reminder of potential risks, and the non-prepared SQL queries warrant careful review. The overall risk is moderate, with potential areas for improvement in consistent SQL sanitization and vigilance against past vulnerability types.