Maps Plugin using Google Maps for WordPress – WP Google Map Security & Risk Analysis

The gmap-embed plugin v1.9.6 presents a mixed security posture. While it demonstrates good practices in areas like output escaping (95% properly) and the use of prepared statements for SQL queries (77%), significant concerns arise from its attack surface. Specifically, two of its four AJAX handlers lack authentication checks, creating potential entry points for unauthorized actions. Furthermore, the taint analysis reveals six high-severity flows with unsanitized paths, indicating potential vulnerabilities if user-supplied input is not handled correctly before being processed or used in sensitive operations. The plugin's history of six known CVEs, all classified as medium severity and covering common types like XSS, CSRF, and privilege escalation, suggests a recurring pattern of security weaknesses that require diligent patching. While there are currently no unpatched CVEs and good capability check usage, the presence of these historical issues coupled with the identified taint flows and unprotected AJAX handlers warrants careful attention.