WooNinjas Salesforce WP to Lead with AffiliateWP Security & Risk Analysis

The "wooninjas-salesforce-wp-to-lead-with-affiliate-wp" plugin version 1.0 presents a generally good security posture based on the provided static analysis. The plugin has a remarkably small attack surface with no apparent entry points like AJAX handlers, REST API routes, shortcodes, or cron events that lack authentication. The absence of dangerous functions, file operations, and external HTTP requests further bolsters its security. However, a significant concern arises from the SQL queries: both queries are not using prepared statements, which is a common vector for SQL injection vulnerabilities. While the plugin has a clean vulnerability history with no known CVEs, this lack of history doesn't negate the inherent risk posed by the raw SQL queries. The moderate percentage of properly escaped outputs is also a minor concern, suggesting a potential for cross-site scripting (XSS) vulnerabilities in the unescaped outputs.