Reflected Cross-Site Scripting in Overstock Affiliate Links for WordPress

CVE-2025-13624

What is CVE-2025-13624?

The Overstock Affiliate Links plugin for WordPress is affected by a Reflected Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the $_SERVER['PHP_SELF'] parameter. This flaw allows attackers, who can coerce a user into clicking malicious links, to execute arbitrary web scripts on affected pages. All versions of the plugin up to and including 1.1 are susceptible, highlighting the need for prompt updates and security measures to safeguard user interactions.

References