CVE-2026-57809

HighCVSS 7.1

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The AffiliateWP plugin version 2.34.0 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.

Risk Assessment

The organization is at risk of affiliate partner session theft, redirects to malicious sites, and theft of affiliate program data.

Recommendation

Update the AffiliateWP plugin to a version above 2.34.0 that eliminates the XSS vulnerability.

Other vulnerabilities in AffiliateWP

CVE-2026-65515High
Unauthenticated Cross Site Scripting (XSS) vulnerability in AffiliateWP plugin up to version 2.35.0. An unauthenticated attacker can inject malicious scripts.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.