PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin Security & Risk Analysis

The 'pretty-link' plugin, version 3.6.20, exhibits a mixed security posture. While it demonstrates good practices with a high percentage of prepared SQL statements and properly escaped output, several concerning areas warrant attention. The significant attack surface, with 49 AJAX handlers, 20 of which lack authentication checks, presents a considerable risk. Furthermore, the presence of a `unserialize` function, a known dangerous function, and taint analysis revealing three high-severity unsanitized flows indicate potential for critical vulnerabilities if not handled with extreme care.

The plugin's vulnerability history, with 8 total known CVEs and a recent one in May 2025, highlights a recurring pattern of security weaknesses. The common types of vulnerabilities (Missing Authorization, XSS, CSRF, SQL Injection) directly correlate with the findings in the static analysis, particularly the unprotected AJAX handlers and the potential for unsanitized input. Although there are currently no unpatched CVEs, the history suggests a consistent need for diligent security patching and code review.

In conclusion, while 'pretty-link' shows strengths in its data handling and output sanitization, the large number of unprotected entry points, the presence of dangerous functions, and the historical trend of vulnerabilities necessitate caution. The high-severity taint flows and the significant number of unprotected AJAX handlers are the most immediate concerns that require remediation.