CVE-2025-3598

🗓️ 18 Apr 2025 05:22:59Reported by WordfenceType

Vulnerability in Coupon Affiliates WordPress plugin allows XSS via commission_summary parameter.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-3598	18 Apr 202505:58	–	circl
CNNVD	WordPress plugin Coupon Affiliates – Affiliate Plugin for WooCommerce 跨站脚本漏洞	18 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter	18 Apr 202505:22	–	cvelist
EUVD	EUVD-2025-11848	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3598	18 Apr 202506:15	–	nvd
Patchstack	WordPress Coupon Affiliates plugin <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter vulnerability	17 Apr 202517:38	–	patchstack
Positive Technologies	PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce	18 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-3598	26 Apr 202500:28	–	redhatcve
Vulnrichment	CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter	18 Apr 202505:22	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (April 14, 2025 to April 20, 2025)	24 Apr 202513:46	–	wordfence

Vulners

Node

elliotvs coupon_affiliates_affiliate_plugin_for_woocommerceRange≤6.3.0wordpress

[
  {
    "vendor": "elliotvs",
    "product": "Coupon Affiliates – Affiliate Plugin for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2d6cf33c-ac40-4892-9345-64ebe61e6be6
plugins	www.plugins.trac.wordpress.org/browser/woo-coupon-usage/tags/6.2.2/inc/functions/functions-all-time.php

15 Apr 2026 00:35Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.00544

SSVC

CWE-79