Post Affiliate Pro Security & Risk Analysis

This plugin exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and having a moderate number of entry points, several concerning signals warrant attention. The presence of `unserialize` without apparent sanitization, combined with a significant percentage of improperly escaped output (77%), suggests potential for code injection and cross-site scripting vulnerabilities. Furthermore, the taint analysis indicates flows with unsanitized paths, although they are not currently classified as critical or high severity, this is still a point of concern. The plugin's vulnerability history reveals a pattern of past SSRF and XSS issues, with one medium and one low severity vulnerability, one of which remains unpatched. The recent vulnerability date (2026-03-20) is highly unusual and likely a data error, but the overall history suggests a recurring need for security vigilance. The unprotected AJAX handler is a direct and immediate risk.