CVE-2026-65515

HighCVSS 7.1

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in AffiliateWP plugin up to version 2.35.0. An unauthenticated attacker can inject malicious scripts.

Risk Assessment

Potential script execution in admin browser, leading to session hijacking or data theft.

Recommendation

Update the AffiliateWP plugin to the latest patched version.

Other vulnerabilities in AffiliateWP

CVE-2026-57809High
The AffiliateWP plugin version 2.34.0 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.