Delivery Area with Google Maps Security & Risk Analysis

The plugin "delivery-area-with-google-maps" v1.3.1 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by avoiding dangerous functions, utilizing prepared statements for all SQL queries, and not making external HTTP requests or performing file operations. The absence of known CVEs and a clean vulnerability history further suggests a generally well-maintained codebase.

However, significant concerns arise from the static analysis. The plugin has a substantial attack surface composed of 5 entry points, with a worrying 4 of them lacking any authentication checks. This means that potentially sensitive actions or data retrieval could be accessed by unauthenticated users. Additionally, the low percentage of properly escaped output (38%) indicates a high risk of cross-site scripting (XSS) vulnerabilities. The lack of nonce checks on AJAX handlers compounds the risk posed by the unprotected AJAX endpoints.

Given the lack of past vulnerabilities, it's possible that these issues have gone unnoticed or unexploited. However, the combination of unprotected entry points and insufficient output sanitization presents a clear and present danger. The plugin's strengths in SQL handling and avoiding other risky operations are overshadowed by these critical weaknesses in authentication and output escaping.