StoryMap Plugin Security & Risk Analysis

The wp-storymap plugin, v2.1, presents a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, file operations, and external HTTP requests. The plugin also implements a reasonable number of nonce and capability checks. However, there are notable concerns regarding SQL query security and output escaping. A significant percentage of SQL queries are not prepared, and a substantial portion of output is not properly escaped. This suggests potential vulnerabilities to SQL injection and Cross-Site Scripting (XSS) if not handled with extreme care by the surrounding WordPress environment.

Taint analysis reveals a concerning number of flows with unsanitized paths, four of which are classified as high severity. This indicates that user-supplied data might be flowing through the application in ways that could be exploited. Coupled with the plugin's vulnerability history, which includes two unpatched medium severity CVEs related to XSS and CSRF, these findings point to a pattern of insecure input handling. The presence of unpatched vulnerabilities, especially given their type and severity, is a significant risk that requires immediate attention.

In conclusion, while wp-storymap exhibits some strengths in its code, the identified risks in SQL query preparation, output escaping, unsanitized taint flows, and most importantly, the existence of unpatched vulnerabilities, significantly detract from its overall security. Users should proceed with caution and ensure their environment is robust against potential exploits.