Locatoraid Store Locator Security & Risk Analysis

The Locatoraid v3.9.68 plugin exhibits several concerning security weaknesses despite some positive attributes. The plugin presents a significant attack surface with 4 out of 4 REST API routes lacking permission callbacks, meaning any user could potentially interact with these endpoints. The static analysis also revealed the use of the deprecated and insecure `create_function` within the code, a known source of vulnerabilities. Furthermore, only 20% of output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. While the majority of SQL queries use prepared statements, this does not mitigate risks from other identified issues.

The plugin's vulnerability history is particularly alarming, with 8 previously disclosed CVEs, including one critical and seven medium-severity vulnerabilities. The fact that one critical vulnerability remains unpatched as of December 31, 2025, is a severe red flag. The common vulnerability types such as XSS, Deserialization of Untrusted Data, and Cross-Site Request Forgery (CSRF) align with the observed code signals, such as poor output escaping and the large attack surface. The presence of file operations and external HTTP requests without clear indications of sanitization further compounds these risks.

In conclusion, while the plugin demonstrates some good practices like using prepared statements for most SQL queries, the combination of a large unprotected attack surface, insecure coding practices like `create_function`, insufficient output escaping, and a history of numerous and significant vulnerabilities, including an unpatched critical one, points to a high-risk plugin. Immediate attention and remediation are strongly advised.