WP Sitemap Security & Risk Analysis

The WPSitemap plugin v1.0.0 exhibits a mixed security posture. On the positive side, the static analysis reveals excellent coding practices regarding SQL queries and output escaping, with 100% of queries using prepared statements and all outputs being properly escaped. There are no identified dangerous functions or file operations. However, a significant concern arises from the absence of nonce checks and capability checks. While the attack surface is currently small (one shortcode), the lack of these critical security measures leaves it vulnerable to various attacks if not properly handled within the shortcode's implementation. Furthermore, the plugin has a known vulnerability history, with one unpatched medium severity CVE related to Cross-Site Scripting (XSS). This indicates a recurring weakness that needs immediate attention.