WPCenter vulnerabilities

Products

• AffiliateX 3
• AffiliateX – Amazon Affiliate Plugin 1

Latest WPCenter CVEs

Newest publication first

1. CVE-2026-65558 WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

   Published 2026-07-27

   Medium·CVSS 5.4 EPSS 0.22%

   Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

2. CVE-2025-13859 AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings

   Published 2026-01-15

   Medium·CVSS 6.4 EPSS 0.20%

   The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_customization_settings AJAX action in versions 1.0.0 to 1.3.9.3. This makes it possible for authenticated attackers, with...

3. CVE-2025-69346 WordPress AffiliateX plugin <= 1.3.9.3 - Broken Access Control vulnerability

   Published 2026-01-06

   Medium·CVSS 4.3 EPSS 0.18%

   Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/a through <= 1.3.9.3.

4. CVE-2024-49692 WordPress AffiliateX plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-29

   Medium·CVSS 5.4 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCenter AffiliateX affiliatex allows Stored XSS.This issue affects AffiliateX: from n/a through <= 1.2.9.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.