MapifyLite (by MapifyPro) Security & Risk Analysis

The mapifylite plugin, version 5.1.1, demonstrates a mixed security posture. On the positive side, it effectively uses prepared statements for all SQL queries and has no reported critical or high-severity vulnerabilities. The absence of file operations and the limited external HTTP requests are also good indicators. However, several areas raise concerns. The presence of an unprotected AJAX handler significantly expands the attack surface without proper authentication, which is a critical oversight. Furthermore, nearly half of the output escaping is not properly handled, suggesting a potential for Cross-Site Scripting (XSS) vulnerabilities, especially when combined with the unsanitized taint flows. The plugin's vulnerability history, though currently clear of unpatched issues, includes a past medium-severity XSS vulnerability, which aligns with the observed output escaping issues and highlights a recurring weakness.