Infusionsoft Affiliates Security & Risk Analysis

The 'infusionsoft-affiliates' plugin v2.4 exhibits a concerning security posture, primarily due to a lack of robust access control and inadequate output sanitization. The presence of two AJAX handlers without authentication checks is a significant risk, potentially allowing unauthorized users to trigger plugin functionalities. Furthermore, the taint analysis revealing two high-severity flows with unsanitized paths, coupled with zero percent proper output escaping, strongly suggests a high likelihood of cross-site scripting (XSS) or other injection vulnerabilities. While the plugin has no recorded vulnerability history and employs prepared statements for some SQL queries, these positive aspects are heavily overshadowed by the identified weaknesses in its entry points and data handling.