Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] <= 5.4.3 (unfixed)
unknown
[en] The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aal_ajax_unit_loading' RST API endpoint. This makes it possible for unauthenticated attackers to read the contents of arbitrary...
- Affected:
- up to 5.4.3
- Fix:
- No patched version reported
- Disclosed:
- Nov 11, 2025
CVE-2025-11451 on NVD →
Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read
high
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aal_ajax_unit_loading' RST API endpoint. This makes it possible for unauthenticated attackers to read the contents of arbitrary files...
- CVSS:
- 7.5
- Affected:
- up to 5.4.3
- Fix:
- No patched version reported
- Disclosed:
- Nov 10, 2025
CVE-2025-11451 on NVD →
Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] < 5.4.3
unknown
[en] The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitra...
- Affected:
- up to 5.4.3
- Fixed in:
- 5.4.3
- Disclosed:
- Oct 4, 2024
CVE-2024-9349 on NVD →
Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scripting
medium
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary we...
- CVSS:
- 6.1
- Affected:
- up to 5.4.2
- Fixed in:
- 5.4.3
- Disclosed:
- Oct 3, 2024
CVE-2024-9349 on NVD →
Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] < 5.1.2
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1.
- Affected:
- up to 5.1.2
- Fixed in:
- 5.1.2
- Disclosed:
- Feb 1, 2024
CVE-2023-52175 on NVD →
Auto Amazon Links <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permiss...
- CVSS:
- 6.4
- Affected:
- up to 5.1.1
- Fixed in:
- 5.1.2
- Disclosed:
- Dec 29, 2023
CVE-2023-52175 on NVD →
Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] < 5.3.2
unknown
[en] The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scri...
- Affected:
- up to 5.3.2
- Fixed in:
- 5.3.2
- Disclosed:
- Oct 20, 2023
CVE-2023-4482 on NVD →
Auto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style
medium
The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts i...
- CVSS:
- 6.4
- Affected:
- up to 5.3.1
- Fixed in:
- 5.3.2
- Disclosed:
- Sep 5, 2023
CVE-2023-4482 on NVD →
Amazon Auto Links <= 4.6.19 - Reflected Cross-Site Scripting
medium
The Amazon Auto Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' and 'name' values in versions up to, and including, 4.6.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...
- CVSS:
- 6.1
- Affected:
- up to 4.6.19
- Fixed in:
- 4.6.20
- Disclosed:
- Aug 16, 2021
Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] < 4.6.20
unknown
Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Auto Amazon Links plugin (versions <= 4.6.19).
- Affected:
- up to 4.6.20
- Fixed in:
- 4.6.20
- Disclosed:
- Aug 16, 2021
Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] < 4.6.20
unknown
The Amazon Auto Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' and 'name' values in versions up to, and including, 4.6.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...
- Affected:
- up to 4.6.20
- Fixed in:
- 4.6.20
- Disclosed:
- Aug 16, 2021
Auto Amazon Links – Amazon Associates Affiliate Plugin [amazon-auto-links] < 4.6.20
unknown
The plugin does not escape some parameters before outputting them back in attributes in an admin page, leading to Reflected Cross-Site Scripting issues
- Affected:
- up to 4.6.20
- Fixed in:
- 4.6.20
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database