CVE-2026-19573
Received Received - Intake

Stored XSS in Affiliate Super Assistant WordPress Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Wordfence

Description
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-19573
EUVD
EUVD-2026-68977

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
affiliate_super_assistent affiliate_super_assistent to 1.10.2 (inc)
affiliate_super_assistent plugin to 1.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Affiliate Super Assistent WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages via the ‘doCommentShortcode’ function due to poor input sanitization and output escaping. These scripts execute when users access the compromised pages.

Detection Guidance

Check WordPress installations for the Affiliate Super Assistent plugin versions up to 1.10.2. Inspect pages for unexpected scripts in comments or input fields. Use security plugins like Wordfence to scan for malicious scripts.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or deface your website. It may also lead to unauthorized data access if users interact with the injected scripts. The impact depends on user privileges and the nature of the injected payload.

Compliance Impact

This vulnerability could violate GDPR by exposing user data or enabling unauthorized access to personal information. For HIPAA, it may risk protected health information if exploited in healthcare-related WordPress sites. Compliance depends on the specific data processed and the extent of the breach.

Mitigation Strategies

Update the Affiliate Super Assistent plugin to the latest version. Remove or disable the plugin if no update is available. Implement web application firewalls to block XSS attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart