Travel Map Security & Risk Analysis

The travelmap-blog plugin v1.0.4 presents a mixed security posture. While it demonstrates good practices by exclusively using prepared statements for SQL queries and has no identified critical taint flows, several areas raise concerns. The low percentage of properly escaped output (34%) suggests a significant risk of Cross-Site Scripting (XSS) vulnerabilities, as user-provided data may be rendered directly in the browser without adequate sanitization. The absence of nonce checks on any entry points, including the single shortcode, is a serious deficiency that leaves the plugin susceptible to Cross-Site Request Forgery (CSRF) attacks. This is further supported by its vulnerability history, which includes past CSRF and XSS issues.

The plugin's history of two known CVEs, one high and one medium severity, despite currently having no unpatched vulnerabilities, indicates a pattern of past security weaknesses. The last recorded vulnerability was in September 2025, suggesting that while current threats may be mitigated, past issues highlight an ongoing need for vigilant security practices. The plugin's strengths lie in its secure SQL handling and the lack of dangerous functions. However, the significant number of unescaped outputs and the complete lack of nonce checks are critical weaknesses that need immediate attention to mitigate potential exploitation.