WP Mapbox GL JS Maps Security & Risk Analysis

The 'wp-mapbox-gl-js' v3.0.1 plugin exhibits a generally good security posture with several positive indicators. The complete absence of SQL injection vulnerabilities due to prepared statements and the lack of critical or high-severity taint flows are strong points. Nonce and capability checks are also present, suggesting an awareness of secure coding practices. However, a significant concern arises from the 40% of output that is not properly escaped, presenting a potential cross-site scripting (XSS) risk. Additionally, the plugin has a history of medium-severity vulnerabilities, specifically XSS, and notably has one currently unpatched CVE from 2025. This pattern, combined with the unescaped output, indicates a recurring weakness that attackers could exploit. While the plugin demonstrates strengths in certain areas, the unpatched vulnerability and the significant percentage of unescaped output warrant careful attention.