While the BeanShell project is being actively developed, it has not published any new releases to Maven Central since 2016. Similarly Günther's beanshell-maven-plugin didn't have any releases since 2017, even if BeanShell itself has published CVE-2016-2510.

Therefore I would propose to replace our BeanShell scripts with Groovy and use GMavenPlus as binding plugin:

• GMavenPlus comes from a reputable source (the Groovy project) with a huge community,
• the last release is less than 7 months old,
• it's an Apache project 😉.

PS: I am not suggesting that we only stick to plugins backed by a large community, but such projects are more likely to be responsive, when things get interesting.