What is the CVSS score of CVE-2026-7330?

CVE-2026-7330 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Auto Affiliate Links are affected by CVE-2026-7330?

The Auto Affiliate Links WordPress plugin (versions ≤6.8.8) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into administrator…

How to fix or mitigate CVE-2026-7330?

Within 24 hours: Inventory all WordPress installations and identify those running Auto Affiliate Links plugin; disable the plugin immediately if version 6.8.8 or earlier is detected. Within 7 days: Update Auto Affiliate Links to version 6.8.8.1 or later and re-enable; audit administrator accounts for unauthorized access or session activity during the vulnerability window. Within 30 days: Review access logs for suspicious AJAX requests to aal_url_stats_save_action and conduct security awareness training on administrators regarding phishing and social engineering that may have exploited compromised sessions.

Auto Affiliate Links CVE-2026-7330

EUVD-2026-28540 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 Wordfence

GHSA-v3rv-7vgj-hq3v

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 09:15 vuln.today

CVE Published

May 08, 2026 - 08:26 nvd

HIGH 7.2

DescriptionCVE.org

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input sanitization on the 'url' POST parameter in the aal_url_stats_save_action() function and a complete absence of output escaping in aal_display_clicks(), where the stored value is echoed directly into an anchor element's href attribute and inner text without esc_url(), esc_attr(), or esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the admin statistics page that execute in an administrator's browser when the page is visited, leveraging a publicly exposed nonce and an unauthenticated AJAX endpoint registered via the wp_ajax_nopriv_ hook.

AnalysisAI

Stored Cross-Site Scripting in Auto Affiliate Links for WordPress allows unauthenticated remote attackers to inject malicious JavaScript into administrator statistics pages through an unprotected AJAX endpoint. The vulnerability stems from missing input sanitization on the 'url' parameter in aal_url_stats_save_action() combined with direct output of stored values in aal_display_clicks() without escaping. Attackers can exploit a publicly exposed nonce and the wp_ajax_nopriv_ hook to store malicious payloads that execute when administrators view click statistics, potentially leading to session hijacking, privilege escalation, or site compromise. Wordfence reported this vulnerability affecting versions through 6.8.8, with a patch released in version 6.8.8.1.

Technical ContextAI

This vulnerability exists in the Auto Affiliate Links WordPress plugin (CPE: cpe:2.3:a:thedark:auto_affiliate_links), specifically in the statistics tracking functionality within aal_stats.php. The plugin registers an AJAX handler using wp_ajax_nopriv_, making the aal_url_stats_save_action() function accessible to unauthenticated requests. WordPress AJAX endpoints registered with wp_ajax_nopriv_ intentionally bypass authentication, typically requiring other security controls like nonce validation. However, the vulnerable code fails to apply WordPress security functions (esc_url(), esc_attr(), esc_html()) when storing and displaying URL data. The aal_display_clicks() function at line 304 directly echoes user-controlled data into href attributes and anchor text, creating a classic Stored XSS condition (CWE-79). The CVSS scope change (S:C) indicates the injected script executes in the administrator's session context, crossing the plugin's trust boundary into the WordPress core administrative interface. The publicly exposed nonce mentioned in the description represents a critical authentication bypass, as WordPress nonces are designed to prevent CSRF but become ineffective when publicly accessible.

RemediationAI

Immediately upgrade to Auto Affiliate Links version 6.8.8.1 or later, which implements proper input sanitization and output escaping as confirmed by the patch changeset at https://plugins.trac.wordpress.org/changeset/3519003/wp-auto-affiliate-links/trunk/aal_stats.php and version comparison at https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-auto-affiliate-links/tags/6.8.8&new_path=%2Fwp-auto-affiliate-links/tags/6.8.8.1. If immediate patching is not possible, implement these compensating controls: disable the plugin until patched (eliminates vulnerability but removes affiliate linking functionality), restrict wp-admin access via IP allowlisting at the web server level (reduces attacker ability to trigger payload execution but does not prevent storage), or implement Web Application Firewall rules to block POST requests to admin-ajax.php containing suspicious JavaScript patterns in the 'url' parameter (may cause false positives with legitimate URLs containing special characters). Note that simply restricting administrative access does not prevent payload injection since the AJAX endpoint is unauthenticated, but it reduces the attack surface for payload execution. Monitor WordPress admin activity logs for unexpected account creations or privilege changes that could indicate successful exploitation.