Vulnerabilities
Summary — last 7 days
New vulnerabilities4,658▼ 575 vs. last week
Critical / high1,868▼ 1,141 vs. last week
New active exploitation (KEV)9▼ 2 vs. last week
Unscored (no CVSS)735▲ 627 vs. last week
More filters
53 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (6.5) | 0.18% | — | ThirstyaffiliatesAI | 10/17/2026 | 10/19/2026 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics. | |
| Deferred | Critical (9.8) | 0.46% | — | Itthinx AffiliatesAI | 10/14/2026 | 10/15/2026 | Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1. | |
| Deferred | High (7.2) | 0.37% | — | Yithemes Yith Woocommerce AffiliatesAI | 10/10/2026 | 10/13/2026 | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0. | |
| Deferred | High (7.1) | 0.24% | — | Sumo Affiliates PROAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. | |
| Deferred | High (7.1) | 0.25% | — | Wpaffiliatemanager Affiliates ManagerAI | 8/18/2026 | 8/20/2026 | Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. | |
| Deferred | Critical (9.3) | 0.40% | — | Wpaffiliatemanager Affiliates ManagerAI | 8/18/2026 | 8/20/2026 | Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions. | |
| Deferred | Medium (6.5) | 0.30% | — | Wpaffiliatemanager Affiliates ManagerAI | 6/26/2026 | 6/29/2026 | Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions. | |
| Deferred | High (7.5) | 0.42% | — | Wpaffiliatemanager Affiliates ManagerAI | 6/15/2026 | 6/17/2026 | Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. | |
| Deferred | High (7.5) | 0.42% | — | Couponaffiliates Coupon AffiliatesAI | 6/15/2026 | 6/17/2026 | Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions. | |
| Deferred | High (7.1) | 0.25% | — | Couponaffiliates Coupon AffiliatesAI | 6/15/2026 | 6/17/2026 | Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions. | |
| Deferred | Medium (6.4) | 0.32% | — | WP Iframe GEO Style FOR Amazon AffiliatesAI | 5/27/2026 | 6/17/2026 | The WP Iframe Geo Style for Amazon affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'adid' Shortcode Attribute in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level… | |
| Deferred | High (7.1) | 0.25% | — | Aa-team Woocommerce Envato AffiliatesAI | 5/26/2026 | 7/24/2026 | Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1. | |
| Deferred | Medium (6.4) | 0.26% | — | Slicewp AffiliatesAI | 5/6/2026 | 6/17/2026 | The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'slicewp_affiliate_url'… | |
| Deferred | Critical (9.8) | 0.38% | — | Fantasticplugins Sumo Affiliates PROAI | 3/25/2026 | 6/17/2026 | Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0. | |
| Deferred | Medium (5.4) | 0.11% | — | ThirstyaffiliatesAI | 2/3/2026 | 6/17/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through <= 3.11.9. | |
| Deferred | High (7.1) | 0.18% | — | Aa-team Woocommerce Sales Funnel BuilderAIAa-team Amazon Affiliates Addon FOR Wpbakery Page BuilderAI | 1/6/2026 | 10/14/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder: from n/a through… | |
| Deferred | High (8.5) | 0.25% | — | Aa-team Amazon Affiliates Addon FOR Wpbakery Page BuilderAI | 12/31/2025 | 9/23/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a… | |
| Deferred | Medium (6.5) | 0.20% | — | Blairwilliams ThirstyaffiliatesAI | 12/9/2025 | 10/7/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Stored XSS.This issue affects ThirstyAffiliates: from n/a through <= 3.11.8. | |
| Deferred | Medium (4.3) | 0.22% | — | Fantasticplugins Sumo Affiliates PROAI | 10/29/2025 | 6/17/2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This issue affects SUMO Affiliates Pro: from n/a through <= 11.0.0. | |
| Deferred | Medium (5.3) | 0.27% | — | Elliot Sowersby Relywp Coupon AffiliatesAI | 10/27/2025 | 10/8/2026 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through <= 7.2.0. | |
| Deferred | High (7.1) | 0.24% | — | Aa-team Woocommerce Envato AffiliatesAI | 10/22/2025 | 10/8/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through <= 1.2.1. | |
| Deferred | Medium (5.5) | 0.22% | — | Elliot Sowersby Rely WP Coupon AffiliatesAI | 9/22/2025 | 10/11/2026 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.8.0. | |
| Deferred | Medium (6.5) | 0.25% | — | Relywp Coupon AffiliatesAI | 8/20/2025 | 6/17/2026 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.4.0. | |
| Deferred | Medium (6.5) | 0.17% | — | Relywp Coupon AffiliatesAI | 7/16/2025 | 6/17/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Cross Site Request Forgery.This issue affects Coupon Affiliates: from n/a through <= 6.4.0. | |
| Deferred | Critical (10) | 0.52% | — | Fantasticplugins Sumo Affiliates PROAI | 6/9/2025 | 6/17/2026 | Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0. |