WP Geo Security & Risk Analysis

The wp-geo plugin version 3.5.1 exhibits a mixed security posture. While the static analysis shows a relatively low attack surface with all identified entry points protected by at least a capability check, there are significant concerns regarding code quality and past vulnerabilities. The analysis reveals that 52% of output is not properly escaped, which is a substantial weakness that could lead to Cross-Site Scripting (XSS) vulnerabilities if malicious input is not handled correctly by the limited number of capability checks. Furthermore, the presence of raw SQL queries without prepared statements is a risk that could be exploited for SQL injection. The plugin's history of known vulnerabilities, including a medium-severity Cross-Site Scripting (XSS) issue that is currently unpatched, is a major red flag, indicating a pattern of insecure coding practices that haven't been fully addressed. The last vulnerability occurring in September 2025 is particularly concerning as it suggests a recent and potentially ongoing security weakness. Although the plugin has no critical taint flows and a limited number of file operations, the combination of unescaped output, raw SQL, and an unpatched medium-severity vulnerability necessitates caution.