Postaffiliatepro Vulnerabilities

Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field vulnerability

CVSS:

6.5

Affected:

up to 1.28.0

Fix:

No patched version reported

Disclosed:

Mar 23, 2026

The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to initiate arbitrary outbound requests from the application and read the retur...

CVSS:

3.8

Affected:

up to 1.28.0

Fix:

No patched version reported

Disclosed:

Mar 20, 2026

CVE-2026-2290 on NVD →

The Post Affiliate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.24.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in...

CVSS:

4.4

Affected:

up to 1.24.9

Fixed in:

1.25.0

Disclosed:

Jul 20, 2023

CVE-2023-38482 on NVD →