CVE-2026-32575: WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

No. The vulnerability is identified as unauthenticated, so exploitation does not require prior authentication.

Yes. The CVSS vector indicates user interaction is required, meaning a user must interact with attacker-supplied content for the XSS to take effect.

Yes. The CVSS attack vector is network-based, indicating the issue can be exploited over the network.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

Affected Software

1 affected component

Fantastic Plugins SUMO Affiliates Pro<=11.7.0

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced