Does PlantUML really have security holes?

Question

Wiki engines

I wanted to install a harmless PlantUML plugin for confluence in my company, but it was rejected on Sat with critical remarks:
1. Insecure own implementation of ssl (empty method)
2. No certificate host verification
3. Reflected cross-site scripting

I'm not very strong in security, questions:
1. How can I test the plugin for these vulnerabilities myself?
2. Are they redundant? It's embarrassing that the plugin is quite popular and there are so many critical vulnerabilities (and hundreds of non-critical ones)

Answer 1

It seems to me that the security guards are carrying some kind of game. For the entire confluence has a little less than 40 CVEs for all the time and plantuml is not listed in any of them.