Description

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:15.360Z",
  "pubdate": "2026-08-06T15:17:15.360Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in AffiliateWP versions <= 2.35.0.\nThis security flaw allows remote, unauthenticated threat actors to inject malicious client-side scripts, typically JavaScript, into vulnerable parameters processed by the application.\nWhen a targeted user interacts with the compromised component, the injected payload executes within the context of their browser session.\nThe primary impact of this vulnerability includes session hijacking, credential theft, redirection to malicious infrastructure, and unauthorized manipulation of the DOM within the affected web application.\nThe affected product is AffiliateWP version 2.35.0 and all prior versions containing the vulnerable codebase.\nRisk implications are significant as the vulnerability does not require prior authentication or privileged access, lowering the barrier to exploitation for external attackers targeting web applications utilizing the affected plugin.\nSuccessful exploitation relies on the victim interacting with the malicious URL or crafted input vector processed by the vulnerable component.",
  "technicalDetails": "The vulnerability resides in AffiliateWP <= 2.35.0 within input handling and output rendering mechanisms that fail to adequately sanitize, validate, or encode user-supplied data before reflecting it back in the HTTP response.\nThe root cause is insufficient context-aware output encoding and a lack of strict input sanitization filters for parameters processed by the application.\nNetwork exposure is fully remote via standard HTTP/HTTPS protocols, requiring no prior network positioning other than the ability to reach the target web server hosting the vulnerable AffiliateWP plugin.\nAuthentication and privilege requirements are entirely absent; the vulnerability can be exploited by unauthenticated external entities.\nThe exploitation method involves crafting a malicious Uniform Resource Locator (URL) or submitting specially formatted input containing HTML and JavaScript payloads targeting the vulnerable parameters exposed by AffiliateWP.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts an exploit payload encapsulated within the vulnerable input vector. Second, the attacker induces a victim, such as an authenticated administrator or regular user, to access the malicious URL or interact with the injected content. Third, the application processes the request and improperly reflects the unsanitized input within the Document Object Model (DOM). Fourth, the victim's browser parses the HTTP response and executes the embedded script payload within the security context of the victim's session.\nPayload behavior encompasses arbitrary JavaScript execution, enabling actions such as accessing document.cookie, reading sensitive DOM elements, performing unauthorized requests on behalf of the user via XMLHttpRequest or Fetch APIs, and altering the visual presentation of the page to mount phishing attacks.\nPost-exploitation impact depends on the privileges of the targeted user interacting with the payload, potentially leading to administrative session takeover if an administrative user falls victim to the exploit."
}