6.4
Medium
CVE-2026-6672 The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
Description
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'slicewp_affiliate_url' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Affiliate Program Suite — SliceWP Affiliates 1.2 | earliest → 1.2.7 | No fix stated |
Other CVEs of Affiliate Program Suite — SliceWP Affiliates
The 4 CVEs of Affiliate Program Suite — SliceWP Affiliates →
CVE-2026-120043
Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter
7.5
High
CVE-2024-12454
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…
6.1
Medium
CVE-2024-8714
The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site…
6.1
Medium