AffiliateWP – Allowed Products Security & Risk Analysis

The static analysis of affiliatewp-allowed-products v1.3.0 reveals an exceptionally small attack surface, with no identified AJAX handlers, REST API routes, shortcodes, or cron events. This is a strong positive indicator for security as it limits potential entry points for attackers. Furthermore, the plugin demonstrates good practices by using prepared statements for all SQL queries and avoiding file operations or external HTTP requests. However, a significant concern is the low percentage of properly escaped output (40%), indicating a risk of Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is rendered without sufficient sanitization. The absence of any reported vulnerabilities in its history is also a positive sign, suggesting a well-maintained or less targeted plugin.