CVE-2026-6672: Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'slicewpaffiliateurl' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SliceWP Affiliates plugin (Affiliate Program Suite)to a version that resolves this vulnerability.Fixed in 1.2.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6672?
CVE-2026-6672 has a moderate severity level due to its potential for enabling stored cross-site scripting attacks.
How do I fix CVE-2026-6672?
To fix CVE-2026-6672, upgrade the Affiliate Program Suite to version 1.2.8 or later.
Who is affected by CVE-2026-6672?
CVE-2026-6672 affects users of the SliceWP Affiliate Program Suite plugin for WordPress versions up to and including 1.2.7.
What type of vulnerability is CVE-2026-6672?
CVE-2026-6672 is categorized as a Stored Cross-Site Scripting (XSS) vulnerability.
What is the impact of exploiting CVE-2026-6672?
Exploiting CVE-2026-6672 can allow attackers to inject malicious scripts that may lead to unauthorized actions or access to sensitive user data.