Stored Cross-Site Scripting Vulnerability in Auto Affiliate Links Plugin for WordPress

CVE-2026-7330

What is CVE-2026-7330?

The Auto Affiliate Links plugin for WordPress exhibits a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in its code. Unauthenticated attackers can exploit this weakness through the 'url' POST parameter, allowing them to inject arbitrary scripts that execute in an administrator's browser. This occurs when affected versions of the plugin store vulnerable data without proper encoding, making the admin statistics page a potential target for malicious web scripts. Users are advised to update to the latest version to mitigate this security risk.

References