MapSVG – Vector maps, Image maps, Google Maps Security & Risk Analysis

The plugin "mapsvg-lite-interactive-vector-maps" v8.10.1 presents a mixed security posture. While it demonstrates good practices in output escaping and a significant portion of SQL queries utilizing prepared statements, several concerning factors are evident. The static analysis highlights a notable attack surface with one unprotected REST API route, indicating a potential entry point for unauthenticated attackers. Furthermore, the presence of a dangerous function like `unserialize` warrants careful scrutiny, as improper handling of serialized data can lead to remote code execution vulnerabilities. The taint analysis, though limited in scope, reveals flows with unsanitized paths, which could be exploited if not thoroughly addressed. The vulnerability history is particularly concerning, with a significant number of past CVEs including high-severity issues like Unrestricted File Upload, Cross-Site Scripting, Code Injection, Missing Authorization, and CSRF. While there are currently no unpatched CVEs, the recurring nature of these vulnerability types suggests potential systemic weaknesses in input validation and authorization mechanisms that could resurface.