Unless I’m missing something that is staring me in the face, you aren’t using add_query_arg() or remove_query_arg(); since those are the only functions affected by this particular exploit you should be safe.
Your code does use the query_vars filter and get_query_var() but neither of those are effected by the exploit you’ve referenced.
Otherwise your code looks good, I do see a typo in the second to last line of “plugin_part2.php”, it should probably be array($id). Without seeing the rest in context I can’t say that you are safe with 100% certainty, but nothing you’ve posted is vulnerable to the exploit you’re asking about.
For anyone who stumbles on this post, the fix for this particular exploit goes like this, any instance of:
add_query_arg($param1, $param2, $old_query_or_uri);
or
remove_query_arg($key, $query);
should be replaced with
esc_url(add_query_arg($param1, $param2, $old_query_or_uri));
or
esc_url(remove_query_arg($key, $query));
respectively.
An excellent write up of this exploit is available in this article.