Executive brief
AffiliateWP, a popular WordPress plugin used to manage affiliate marketing programs, contains a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a site administrator or visitor into clicking a specially crafted link, an attacker could steal login sessions, redirect users to fraudulent websites, or deface page content. This could lead to unauthorized access to the affiliate management system or damage to the website's reputation.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the AffiliateWP plugin for WordPress due to insufficient input sanitization and output escaping. An unauthenticated remote attacker can exploit this by sending a crafted URL to a victim, which executes arbitrary JavaScript in the context of the victim's browser session. This vulnerability is classified under CWE-79 and requires user interaction (clicking a link). Successful exploitation can lead to session hijacking or unauthorized actions performed on behalf of a logged-in administrator. The issue is resolved in version 2.34.1.
Affected products
- AffiliateWP AffiliateWP <= 2.34.0
Timeline
- 2026-05-19: other: Reported by researcher dutafi
- 2026-07-21: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD
- 2026-07-21: patched: Version 2.34.1 released to address the vulnerability