XML Sitemap Generator for Google Security & Risk Analysis

The "google-sitemap-generator" plugin version 4.1.23 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for a significant majority of its SQL queries and properly escaping most of its output. The presence of numerous nonce and capability checks suggests an effort to secure its entry points, and the limited attack surface with no unprotected entry points is a strong indicator of a well-secured design at first glance. However, the static analysis reveals potential areas of concern. The use of the `unserialize` function is a known risk, as it can lead to remote code execution if used with untrusted input. While the taint analysis did not flag critical or high severity flows with unsanitized paths, the presence of two such flows warrants attention as they could potentially be exploited under specific circumstances. The vulnerability history, with three medium severity CVEs previously discovered, including Cross-site Scripting and Missing Authorization, indicates a past susceptibility to common web vulnerabilities. Although there are no currently unpatched vulnerabilities and the last one was in 2025, this history suggests a pattern of past security weaknesses that, combined with the `unserialize` function, requires continued vigilance.