CVE-2025-2077: Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scripting
First published: Wed Mar 12 2025(Updated: )
The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Simple Affiliate | <=1.0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2077?
CVE-2025-2077 has a medium severity level due to its potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2025-2077?
To fix CVE-2025-2077, update the Simple Amazon Affiliate plugin to version 1.0.10 or later, which addresses the vulnerability.
Who is affected by CVE-2025-2077?
Anyone using the Simple Amazon Affiliate plugin for WordPress versions up to and including 1.0.9 is affected by CVE-2025-2077.
What type of attack is CVE-2025-2077 associated with?
CVE-2025-2077 is associated with reflected cross-site scripting (XSS) attacks.
Can unauthenticated users exploit CVE-2025-2077?
Yes, unauthenticated attackers can exploit CVE-2025-2077 due to insufficient input sanitization in the affected plugin.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/last-modified-date
- agent/tags
- agent/author
- agent/severity
- agent/event
- vendor/amazon
- canonical/amazon simple affiliate