CVE-2026-119089

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...

CVE-2026-119089 ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...

CVE-2026-119089

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.12.1 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter ....

EUVD-2026-114598

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...

CVE-2026-119089: supercleanse: The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is…

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...

WordPress ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin ThirstyAffiliates versions = 3.12.1...

WordPress ThirstyAffiliates plugin < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection vulnerability

Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection vulnerability discovered by Usama Arshad in WordPress Plugin ThirstyAffiliates versions 3.12.1...

CVE-2026-97314

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics...

CVE-2026-97314

The ThirstyAffiliates WordPress plugin (versions before 3.12.1 ) contains a vulnerability in its link redirect tracking handler. The component fails to validate the status or type of the requested object, which enables unauthenticated attackers to disclose destination URLs for unpublished affilia...

CVE-2026-97314 ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics...

CVE-2026-97314 ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics...

EUVD-2026-103260

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics...

PT-2026-116377

Name of the Vulnerable Software and Affected Versions ThirstyAffiliates versions prior to 3.12.1 Description An issue exists in the link redirect tracking handler that fails to verify the status or type of the requested object. This allows unauthenticated attackers to disclose destination URLs of...

CVE-2026-97314: Exposure of Sensitive Information to an Unauthorized Actor

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics...

CVE-2026-25024

Cross-Site Request Forgery CSRF vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through = 3.11.9...

CVE-2026-25024

Cross-Site Request Forgery CSRF vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through = 3.11.9...

CVE-2026-25024

Cross-Site Request Forgery CSRF vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through = 3.11.9...

CVE-2026-25024

CVE-2026-25024 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin ThirstyAffiliates (thirstyaffiliates) by Blair Williams, affecting versions up to and including 3.11.9. The Red Hat, NVD, CVE List, and related sources consistently state the issue is CSRF and affec...

EUVD-2026-5308

Cross-Site Request Forgery CSRF vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through = 3.11.9...

CVE-2026-25024 WordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through = 3.11.9...