SVG Map by Smjrifle Security & Risk Analysis

The "svg-map-by-saedi" plugin, version 1.0.3, exhibits a mixed security posture. On the positive side, it demonstrates good practices by using prepared statements for all SQL queries and properly escaping the vast majority of its output. The absence of dangerous functions and external HTTP requests is also encouraging. However, the plugin presents significant risks due to its unprotected entry points.

Specifically, the presence of three AJAX handlers without authentication checks represents a critical vulnerability. This lack of authorization means that any user, potentially including unauthenticated visitors, could trigger these handlers, leading to unpredictable behavior or even unauthorized actions. While the taint analysis shows no unsanitized paths, the sheer number of unprotected AJAX handlers creates a substantial attack surface that could be exploited.

The plugin's vulnerability history, which includes one known medium-severity CVE that is currently unpatched, is a significant concern. The fact that the last vulnerability occurred in the future (2026-01-06) suggests potential data inaccuracies or a placeholder for future events, but the presence of an unpatched vulnerability itself is a red flag. The common vulnerability type being Cross-Site Request Forgery (CSRF) further emphasizes the need for robust authentication and authorization mechanisms, which are clearly lacking in the exposed AJAX handlers. The plugin's strengths lie in its secure handling of database interactions and output, but these are overshadowed by the critical security flaws in its entry points and the existence of an unpatched vulnerability.