XML Sitemap for Google Security & Risk Analysis

The "xml-sitemap-for-google" plugin v1.1.7 demonstrates several positive security practices, including the absence of dangerous functions, 100% use of prepared statements for SQL queries, and a very high percentage of properly escaped output. The lack of any recorded historical vulnerabilities or CVEs is also a strong indicator of good security maintenance. However, a significant concern arises from the static analysis, which reveals four AJAX handlers that lack authentication checks, representing a substantial attack surface without proper authorization. While there are nonce checks present for these handlers, their absence of capability checks means any logged-in user, regardless of their role, could potentially trigger these actions.

The taint analysis shows no critical or high-severity vulnerabilities, which is encouraging. The plugin also avoids file operations and external HTTP requests, reducing common attack vectors. Despite the positive aspects, the unprotected AJAX endpoints are a notable weakness. The vulnerability history being clean is a positive trend, suggesting the developers are generally attentive to security, but it does not negate the immediate risks identified in the current code analysis. Overall, while the plugin has a good foundation, the unprotected AJAX endpoints require immediate attention to mitigate potential unauthorized actions.