What is the CVSS score of CVE-2026-65515?

CVE-2026-65515 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of AffiliateWP are affected by CVE-2026-65515?

The AffiliateWP WordPress plugin (versions ≤2.35.0) contains a cross-site scripting vulnerability (CVE-2026-65515) that enables attackers to hijack administrator sessions and execute unauthorized…

How to fix or mitigate CVE-2026-65515?

Within 24 hours, audit all WordPress installations to identify instances of AffiliateWP version 2.35.0 or earlier and assess production exposure. Within 7 days, implement Web Application Firewall rules to block XSS patterns and disable the plugin on non-critical systems; review WordPress access logs for exploitation attempts. Within 30 days, monitor AffiliateWP's official advisory and security channels for patch availability, then plan and execute upgrades to the patched version across all affected sites.

AffiliateWP CVE-2026-65515

EUVD-2026-53967 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-pjm5-g378-cvc8

WordPress XSS Wordpress Plugin Affiliatewp

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with unauthenticated network delivery and scope change; A:N assigned as XSS does not typically cause availability loss on the hosting system.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:28 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

AnalysisAI

Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

AffiliateWP is a commercial affiliate marketing plugin for WordPress, responsible for tracking referral links, managing affiliates, and generating commission data. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input is rendered in an HTML context without adequate sanitization or encoding, allowing script injection. The CVSS Scope:Changed metric confirms that script execution escapes the plugin's own trust boundary and operates within the victim's browser session - a distinct security principal - enabling access to cookies, DOM content, and the ability to perform credentialed actions on behalf of the victim. The CPE string cpe:2.3:a:affiliatewp:affiliatewp:*:*:*:*:*:*:*:* with a wildcard version component confirms the full range through 2.35.0 is affected.

RemediationAI

Update AffiliateWP to a version above 2.35.0; the specific patched release version is not confirmed from available data and must be verified directly via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/affiliate-wp/vulnerability/wordpress-affiliatewp-plugin-2-35-0-cross-site-scripting-xss-vulnerability or the plugin's official changelog. As an interim compensating control, deploy a Web Application Firewall (WAF) rule - such as those provided by Wordfence or Cloudflare - to block XSS payloads in AffiliateWP-related request parameters; note that overly aggressive WAF rules may block legitimate affiliate tracking parameters and should be tested in audit mode first. Implementing a strict Content Security Policy (CSP) header on the WordPress site (e.g., script-src 'self') reduces the blast radius of a successful XSS by preventing inline script execution and cross-origin data exfiltration, but does not eliminate the vulnerability itself and may require tuning to avoid breaking legitimate site functionality.