VulnSocial

CVE-2026-7330Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input sanitization on the 'url' POST parameter in the aal_url_stats_save_action() function and a complete absence of output escaping in aal_display_clicks(), where the stored value is echoed directly into an anchor element's href attribute and inner text without esc_url(), esc_attr(), or esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the admin statistics page that execute in an administrator's browser when the page is visited, leveraging a publicly exposed nonce and an unauthenticated AJAX endpoint registered via the wp_ajax_nopriv_ hook.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-05-08); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-08: 2Mentions · 2026-05-09: 1Technical Details · 2026-05-08: 2Technical Details · 2026-05-09: 105-0805-09
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-082
Disclosure2
2026-05-091
Disclosure1
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-7330 The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input san… https://www.cve.org/CVERecord?id=CVE-2026-7330

    Post summary

    The CVE-2026-7330 disclosure highlights a stored XSS flaw in the Auto Affiliate Links WordPress plugin (v6.8.8 and earlier) caused by insufficient input sanitization; no PoC, exploit, patch, or active exploitation details are provided.

    00000136
    57.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-7330 Stored Cross-Site Scripting in Auto Affiliate Links Plugin for WordPress Up to 6.8.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7330

    Post summary

    CVE‑2026‑7330 is a stored XSS vulnerability affecting the Auto Affiliate Links WordPress plugin up to version 6.8.8, with no PoC or exploit details provided in the text.

    0000040
    4.0K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-7330 The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclu… CVSS 7.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-7330 #WordPress #CyberSecurity #InfoSec

    Post summary

    The text announces CVE‑2026‑7330 as a stored XSS vulnerability in the Auto Affiliate Links WordPress plugin, provides a CVSS score of 7.2, and links to a full analysis.

    0000060
    516 followersView on X

Explore more

Back to dashboard