WP Affiliate Disclosure Security & Risk Analysis

The "wp-affiliate-disclosure" v1.2.10 plugin exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query handling and the absence of dangerous functions, significant concerns arise from its attack surface and output sanitization. A large number of AJAX handlers (7 out of 9) lack authentication checks, presenting a substantial entry point for unauthorized actions. Furthermore, only 18% of its output is properly escaped, indicating a high potential for Cross-Site Scripting (XSS) vulnerabilities, especially given the plugin's vulnerability history which includes XSS and missing authorization.

The plugin's past CVEs, specifically the presence of high and medium severity vulnerabilities related to XSS and authorization issues, are concerning. Although there are currently no unpatched CVEs, the historical pattern suggests a recurring weakness in handling user input and access control. The presence of a bundled Freemius library also warrants attention, as outdated versions of such components can introduce vulnerabilities. Overall, the plugin has strengths in its database interaction but is significantly weakened by its broad, unprotected attack surface and insufficient output sanitization, making it a moderate risk.