Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) Security & Risk Analysis

The Leaflet Maps Marker plugin v3.12.10 exhibits a mixed security posture. While the plugin has a small attack surface with only one unprotected AJAX handler, and a good number of capability checks and nonces present, concerns arise from the code analysis. A significant portion of SQL queries (44%) are not using prepared statements, presenting a potential SQL injection risk. Furthermore, less than half of the output operations are properly escaped, indicating a risk of Cross-Site Scripting (XSS) vulnerabilities. The vulnerability history shows a pattern of common web vulnerabilities like XSS and SQL injection, with several high and medium severity CVEs historically. The fact that there are currently no unpatched vulnerabilities is positive, but the repeated nature of these vulnerability types suggests a need for more robust input validation and output sanitization practices.