CoreCVE
Back

MEDIUM

Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter

Published Apr 18, 2025

Description

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commission_summary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Wordfence
Published Apr 18, 2025
Updated Apr 8, 2026
Reserved Apr 14, 2025
Link CVE-2025-3598

CISA Vulnrichment

Updated Apr 18, 2025

NVD

Status Deferred
Modified Jun 17, 2026
Link CVE-2025-3598

Red Hat

No data

ENISA EUVD

Assigner Wordfence
Published Apr 18, 2025
Updated Apr 8, 2026
Link EUVD-2025-11848

GitHub

No data