Affiliate Press Security & Risk Analysis

The plugin "affiliate-press" v0.3.8 exhibits a mixed security posture. On the positive side, there are no recorded CVEs and the plugin demonstrates a good practice by not directly handling file operations or making excessive external HTTP requests. The presence of nonce checks is also a positive indicator. However, several concerning signals arise from the static analysis. A significant portion of SQL queries (57%) are not using prepared statements, which opens the door to potential SQL injection vulnerabilities if not handled meticulously. Furthermore, a very low percentage (10%) of output is properly escaped, suggesting a high risk of Cross-Site Scripting (XSS) vulnerabilities across various output contexts. The taint analysis is particularly alarming, with 100% of analyzed flows showing unsanitized paths, and a notable 5 flows classified as high severity. This indicates that data entering the plugin is not being adequately cleaned, which could lead to serious security issues.