Stored Cross-Site Scripting Vulnerability in WP Iframe Geo Style for Amazon Affiliates Plugin

CVE-2026-8837

What is CVE-2026-8837?

The WP Iframe Geo Style for Amazon Affiliates plugin for WordPress is affected by a stored cross-site scripting vulnerability that arises from inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access or higher to exploit the 'adid' shortcode attribute, enabling them to inject arbitrary web scripts. The malicious scripts can execute automatically on pages viewed by users, posing a significant risk to site integrity and user security.

References