Google Maps and Distance Finder plugin Security & Risk Analysis

The "google-maps-and-distance-finder" plugin version 1.0 presents a mixed security posture. On the positive side, it has a very limited attack surface, with only one shortcode identified as an entry point. Crucially, there are no known CVEs associated with this plugin, and the code analysis shows a complete absence of dangerous functions and external HTTP requests. All SQL queries are properly prepared, indicating good database interaction practices.

However, significant concerns arise from the output escaping and taint analysis. A substantial portion of the code exhibits improperly escaped output, posing a risk of Cross-Site Scripting (XSS) vulnerabilities, especially given the one identified flow with an unsanitized path. The complete lack of nonce checks and capability checks, even for the single shortcode, is a major oversight. This means that any user, regardless of their role or authentication status, could potentially interact with the shortcode in unintended ways, leading to unexpected behavior or even more severe security issues if combined with other weaknesses.

While the vulnerability history is clean, this may be due to the plugin's limited scope or simply an absence of past discoveries. The current code analysis reveals critical areas for improvement. The primary risks stem from potential XSS due to unescaped output and the lack of authorization/integrity checks on the shortcode, which could be exploited.