What is the CVSS score of CVE-2026-57809?

CVE-2026-57809 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of AffiliateWP are affected by CVE-2026-57809?

AffiliateWP, widely used to operate WordPress-based affiliate programs, is vulnerable to reflected cross-site scripting (CVE-2026-57809) that allows unauthenticated attackers to steal customer and…

How to fix or mitigate CVE-2026-57809?

Within 24 hours, inventory all WordPress instances running AffiliateWP 2.34.0 and earlier to identify which handle sensitive customer or affiliate data. Within 7 days, deploy Web Application Firewall rules to block reflected XSS payloads against AffiliateWP endpoints, implement strict output encoding on user-supplied data, and apply Content Security Policy headers to prevent inline script execution; if business operations permit, disabling the plugin entirely eliminates the attack surface. Within 30 days, monitor vendor advisories for patch releases and threat intelligence feeds for proof-of-concept exploits; prepare to immediately test and deploy AffiliateWP updates once available.

AffiliateWP CVE-2026-57809

EUVD-2026-48184 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-jhq4-cj7p-3f3v

WordPress XSS Wordpress Plugin Affiliatewp

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable reflected XSS (PR:N/AV:N/AC:L) requiring victim click (UI:R); browser-context script crosses into the site session (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:24 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

AnalysisAI

Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.

Technical ContextAI

AffiliateWP is a commercial WordPress plugin used to run affiliate/referral marketing programs on self-hosted WordPress sites, handling affiliate registration, referral tracking, and payout dashboards. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is reflected into an HTML response without adequate output encoding or sanitization, allowing script injection. The affected component is identified by CPE cpe:2.3:a:affiliatewp:affiliatewp:*:*:*:*:*:*:*:* covering all versions up to and including 2.34.0; because this is reflected (not stored) XSS, the malicious input travels in the request and is echoed back in the same response rather than persisted server-side.

RemediationAI

Upgrade AffiliateWP to a release later than 2.34.0 once the vendor publishes a fixed version; the provided intelligence does not specify an exact patched version, so confirm the fixed build directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/affiliate-wp/vulnerability/wordpress-affiliatewp-plugin-2-34-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's changelog before deploying. As compensating controls until patched, deploy a WordPress-aware WAF or virtual patch (Patchstack and similar services offer signatures for this exact CVE) to filter reflected XSS payloads on the affected endpoint, and enforce a restrictive Content-Security-Policy that disallows inline script execution to blunt payload impact - noting that a strict CSP can break legitimate inline scripts and third-party integrations and should be tested in report-only mode first. Administrators should also avoid clicking untrusted links pointing at their own site's affiliate parameters.