Thirstyaffiliates Affiliate Links Link Branding Link Tracking Marketing Plugin
Monthly
Stored cross-site scripting in the ThirstyAffiliates WordPress plugin through version 3.12.1 lets remote attackers inject arbitrary script through the 'comment' parameter, which is then rendered to other visitors. Exploitation is constrained: the site must run a block theme (e.g. Twenty Twenty-Five) so the Comment Content block pushes comment HTML through render_block and triggers the plugin's transformer, and the attacker must first have one comment approved before later crafted comments auto-approve and render publicly. Wordfence's vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), with scope change reflecting execution in other users' browser context; a public advisory and source references are available, but no confirmed working exploit code, KEV listing or EPSS signal was provided, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the ThirstyAffiliates WordPress plugin through version 3.12.1 lets remote attackers inject arbitrary script through the 'comment' parameter, which is then rendered to other visitors. Exploitation is constrained: the site must run a block theme (e.g. Twenty Twenty-Five) so the Comment Content block pushes comment HTML through render_block and triggers the plugin's transformer, and the attacker must first have one comment approved before later crafted comments auto-approve and render publicly. Wordfence's vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), with scope change reflecting execution in other users' browser context; a public advisory and source references are available, but no confirmed working exploit code, KEV listing or EPSS signal was provided, and no public exploit was identified at time of analysis.