CVE-2026-119089— ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

Quick assessment

Affected

supercleanse ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 ThirstyAffiliates（用于联盟链接、链接品牌化、链接跟踪与营销）在所有 3.12.1 及更早版本中，因输入过滤不足且输出未进行转义，导致其通过参数存在存储型跨站脚本（Stored XSS）漏洞。该漏洞允许未认证的攻击者在页面中注入任意 Web 脚本，当用户访问被注入的页面时，这些脚本将被执行。此漏洞仅在块主题（例如 Twenty Twenty-Five）上可被利用：在这些主题中，"Comment Content"（评论内容）区块会导致评论 HTML 经过函数处理，从而触

CVSS 7.2 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1193

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

Source: CVE Program / CVE List V5

Vulnerability Description

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
supercleanse	ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin	0 ~ 3.12.1	-

II. Public POCs for CVE-2026-119089

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119089

请登录查看更多情报信息。

Other References for CVE-2026-119089 (5)

https://www.cve.org/CVERecord?id=CVE-2026-119089

IV. Related Vulnerabilities

Same vendor: supercleanse

Same weakness: CWE-79