Reflected Cross-Site Scripting Vulnerability in Coupon Affiliates Plugin for WooCommerce

CVE-2025-3598

What is CVE-2025-3598?

The Coupon Affiliates – Affiliate Plugin for WooCommerce is vulnerable to reflected Cross-Site Scripting (XSS) via the 'commission_summary' parameter. This vulnerability stems from inadequate input sanitization and output escaping in all versions up to and including 6.3.0. Attackers can exploit this flaw to inject arbitrary web scripts into web pages, which execute in the browser if a victim is deceived into clicking a link. This poses significant risks, especially for users and their data, as unauthorized scripts can execute actions on behalf of the user without their consent.

References