Stored Cross-Site Scripting Vulnerability in Affiliate Super Assistent WordPress Plugin

The Affiliate Super Assistent plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) flaw identified as CVE-2026-19573. The issue exists within the ‘doCommentShortcode’ function, which fails to properly sanitize user-supplied input or escape output before rendering it in the browser. An unauthenticated attacker can leverage this weakness to inject malicious JavaScript into web pages served by the plugin. When a legitimate user or administrator views an affected page, the injected script executes within the victim's session, potentially leading to unauthorized actions, session hijacking, or the defacement of the site. This vulnerability affects all versions of the Affiliate Super Assistent plugin up to and including 1.10.2. Defending against this threat requires immediate patching or removal of the vulnerable plugin, as the lack of input sanitization provides a direct vector for script injection.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user who visits the compromised page. This can lead to account takeover, the redirection of users to malicious domains, or the theft of sensitive session cookies. Given the nature of Stored XSS, these attacks persist until the malicious payload is manually removed from the database or the underlying vulnerability is remediated.

Recommendation

• Update the Affiliate Super Assistent plugin to a version released after 1.10.2 to remediate CVE-2026-19573.
• Audit database content associated with the Affiliate Super Assistent plugin for suspicious script tags or obfuscated JavaScript.
• Monitor web server access logs for anomalous POST requests directed at endpoints responsible for comment submissions or form processing utilized by the plugin.