Store Locator Plus® | Gravity Forms Locations Security & Risk Analysis

The 'slp-gravity-forms-locations' plugin, in version 6.1.1, exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and has a high rate of properly escaped output. The absence of known CVEs and a clean vulnerability history suggest a generally well-maintained codebase in the past. However, significant concerns arise from its attack surface and code signals. The presence of a single AJAX handler without authentication checks represents a critical vulnerability point, potentially allowing unauthorized actions. Furthermore, the use of the 'create_function' dangerous function, while not directly exploitable without a specific vulnerability path, is a code smell that can lead to security issues in the future and is often a precursor to vulnerabilities. The plugin also includes the Freemius v1.0 library, which, depending on its age and patching status, could introduce its own risks if outdated.