Description

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-01T05:17:09.233Z",
  "pubdate": "2026-09-01T05:17:09.233Z",
  "executiveSummary": "The Affiliate Super Assistent plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from inadequate input sanitization and output escaping within the 'doCommentShortcode' function.\nThe security flaw affects all plugin versions up to and including 1.10.2.\nBy leveraging this flaw, unauthenticated attackers can inject and persist malicious JavaScript payloads into vulnerable WordPress pages.\nWhen an unsuspecting user, such as an administrator or authenticated user, visits the affected page, the injected script executes within the context of their session.\nThis can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or further site compromise.\nThe vulnerability represents a significant security risk due to the lack of required authentication for exploitation and the potential for broad impact depending on the victim's privilege level.",
  "technicalDetails": "The root cause of this vulnerability lies in the 'doCommentShortcode' function within the Affiliate Super Assistent plugin, which fails to properly sanitize user-supplied input before storing it in the database and subsequently fails to properly escape this data when rendering it in the browser.\nStored XSS occurs when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe manner.\nIn this specific case, the 'doCommentShortcode' function processes shortcode attributes or content that are not adequately validated or escaped before being processed by the WordPress rendering engine.\nAn unauthenticated attacker can craft a malicious payload containing JavaScript, such as '<script>alert(document.cookie)</script>', and submit it through vectors that the 'doCommentShortcode' function handles.\nBecause the input is insufficiently sanitized, the malicious script is stored directly in the WordPress database.\nWhenever a user navigates to a post or page containing the affected shortcode, the server retrieves the unsanitized malicious script from the database and inserts it directly into the HTML response sent to the user's browser.\nThe victim's browser, upon parsing the HTML, interprets the injected script as legitimate code originating from the trusted domain and executes it within the context of the user's session.\nThis execution happens entirely client-side, allowing the script to interact with the Document Object Model (DOM), access sensitive session cookies (if not protected by HttpOnly flags), manipulate the page content, or perform unauthorized administrative actions.\nThe attack flow requires no interaction from the site administrator to initiate the storage of the malicious payload, as the vulnerability is accessible to unauthenticated remote attackers.\nThe post-exploitation impact is severe, as successful execution of scripts can lead to full site compromise if administrative sessions are hijacked or if the injected script forces the administrator to perform malicious actions."
}