Maps Widget for Google Maps Security & Risk Analysis

The google-maps-widget plugin version 4.27 exhibits a mixed security posture. On the positive side, it demonstrates good practices by having no SQL queries that are not prepared, no file operations, and no identified critical or high severity taint flows. The presence of nonce and capability checks on its AJAX handlers, although limited, is also a good sign. However, concerns arise from the output escaping, where 74% is properly escaped, leaving a significant portion (26%) potentially vulnerable to Cross-Site Scripting (XSS) if not handled with care. The plugin also makes 5 external HTTP requests, which could be a vector for supply chain attacks if the external services are compromised.

The vulnerability history reveals two medium severity CVEs, both related to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). The fact that there are no currently unpatched vulnerabilities is reassuring, but the recurring nature of XSS and CSRF suggests that input sanitization and output encoding might require more robust implementation. The last vulnerability was in April 2023, indicating that while the plugin has been updated, past issues warrant continued vigilance. Overall, the plugin has strengths in its prepared SQL and lack of critical taint issues, but the output escaping and past vulnerability types highlight areas for improvement.