exovia GDPR Google Maps Security & Risk Analysis

The "exactly-gdpr-google-maps" v1.0.16 plugin exhibits a mixed security posture. On the positive side, there are no known vulnerabilities (CVEs) or critical taint flows identified. The absence of file operations and external HTTP requests is also reassuring. However, significant concerns arise from the static analysis. The plugin lacks any capability checks or nonce checks, which are fundamental security mechanisms in WordPress. This means that the single shortcode, while not an AJAX or REST API endpoint, could potentially be exploited if it handles user-supplied data without proper sanitization or authorization, although no specific unsanitized flows were detected.

The plugin's SQL query practices are also a point of concern, with 100% of its SQL queries not using prepared statements. This is a critical vulnerability that exposes the application to SQL injection attacks. Furthermore, only 37% of output escaping is properly implemented, suggesting potential cross-site scripting (XSS) vulnerabilities in areas where user-controlled data is displayed without adequate sanitization.

Overall, while the plugin has a clean vulnerability history and no critical technical flaws like taint flows, the lack of fundamental security checks (capability/nonce) and poor handling of SQL queries and output escaping present a notable risk. Users should be cautious until these weaknesses are addressed.