CVE-2026-73358
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
Risk Assessment
An attacker can inject malicious script that executes in the admin's browser, potentially leading to session theft or admin panel takeover.
Recommendation
Update the Affiliates Manager plugin to the latest version that includes the security fix.
Other vulnerabilities in Affiliates Manager
See all- CVE-2026-73355Critical
Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.
- CVE-2026-57654Medium
The Affiliates Manager plugin version 2.9.49 and earlier suffers from a broken access control vulnerability for affiliates. This allows unauthorized users to perform actions they should not have permission to.
- CVE-2026-52692High
Versions of Affiliates Manager up to 2.9.50 have a vulnerability that allows unauthorized access to sensitive data.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS