Events Manager – OpenStreetMaps Security & Risk Analysis

The 'stonehenge-em-osm' plugin v4.2.1 presents a moderate security risk. While it demonstrates some positive security practices, such as a relatively low number of file operations and external HTTP requests, and a decent percentage of SQL queries using prepared statements and output escaping, significant concerns remain. The most alarming finding is the large attack surface with 17 AJAX handlers, 16 of which lack authentication checks. This is a major gateway for potential unauthorized actions. Furthermore, the presence of one unsanitized path in the taint analysis, even without critical or high severity, indicates a potential for vulnerability that needs investigation. The plugin's vulnerability history, including a known medium-severity CVE that is currently unpatched and related to Cross-Site Scripting, reinforces the need for caution. This suggests a pattern of past security flaws that have not been fully addressed, increasing the likelihood of future exploitable issues. Overall, the plugin has some strengths but is significantly weakened by its numerous unprotected entry points and a history of unpatched vulnerabilities.