CVE-2026-65515 Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions

Description

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

Affected products and versions

Product	Affected versions	Fixed in
AffiliateWP 2.35	earliest → 2.35.0	No fix stated

Other CVEs of AffiliateWP

The 5 CVEs of AffiliateWP →

CVE-2026-57809 Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions 7.1 High CVE-2025-8877 The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in… 7.5 High CVE-2024-5286 The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it… 4.8 Medium CVE-2023-4600 The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… 4.3 Medium