AffiliateX – Amazon Affiliate Plugin Security & Risk Analysis

The affiliatex plugin v1.4.2.2 exhibits a mixed security posture. On the positive side, it demonstrates strong practices with 100% of SQL queries using prepared statements and a very high percentage (97%) of properly escaped output. The absence of dangerous functions, file operations, and taint flows with unsanitized paths are also encouraging signs. However, the plugin has a notable attack surface with 9 AJAX handlers, 4 of which lack authentication checks, presenting a significant concern. While there are no currently unpatched CVEs, the history of 3 medium severity vulnerabilities, including missing authorization and cross-site scripting, is a red flag, suggesting recurring security weaknesses in these areas. The last vulnerability being in 2026 also suggests this analysis might be based on future information or a typo.