AffiliateWP – Store Credit Security & Risk Analysis

The plugin "affiliatewp-store-credit" v2.6.2 exhibits a strong security posture based on the provided static analysis and vulnerability history. The absence of any known CVEs and a clean bill of health in the vulnerability history indicate a well-maintained and secure codebase over time. The static analysis further reinforces this, revealing no dangerous functions, all SQL queries using prepared statements, no file operations or external HTTP requests, and a single nonce check on an AJAX handler, which is a good practice. Capability checks are also present, adding another layer of defense.

However, a minor area for attention is the output escaping. While 85% of outputs are properly escaped, this leaves 15% potentially unescaped. This could represent a minor risk of cross-site scripting (XSS) vulnerabilities if sensitive data is being outputted without proper sanitization in those specific instances. The taint analysis showing zero flows with unsanitized paths is a very positive indicator, suggesting that even with potentially unescaped outputs, the actual risk of exploitation might be low due to the nature of the data or how it's handled within the plugin's context. Overall, this plugin appears to be secure, with the only notable concern being the small percentage of unescaped outputs.