Reviews Block for Google Security & Risk Analysis

The 'google-places-reviews' v2.0.1 plugin exhibits a mixed security posture. While it demonstrates good practices by using prepared statements for all SQL queries and avoiding dangerous functions and file operations, several significant concerns are present. The attack surface is notable, with 3 entry points, 2 of which lack proper authentication or permission checks. This creates potential pathways for unauthorized access or actions. The output escaping is also a weakness, with less than half of the outputs being properly escaped, indicating a risk of Cross-Site Scripting (XSS) vulnerabilities. The plugin's vulnerability history, including a past medium-severity XSS vulnerability, further underscores the importance of careful input handling and output sanitization. While the absence of critical taint flows and unpatched CVEs is positive, the identified weaknesses in authentication and output escaping warrant attention.