Woo Coupon Usage Vulnerabilities

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

CVSS:

4.3

Affected:

up to 7.8.1

Fixed in:

7.8.2

Disclosed:

Jun 9, 2026

CVE-2026-49068 on NVD →

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 5.17.2

Fixed in:

5.19.0

Disclosed:

Apr 30, 2026

CVE-2024-13362 on NVD →

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

CVSS:

7.2

Affected:

up to 7.5.3

Fixed in:

7.6.0

Disclosed:

Apr 21, 2026

CVE-2026-40770 on NVD →

[en] Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through <= 7.0.3.

Affected:

up to 7.0.3

Fix:

No patched version reported

Disclosed:

Oct 27, 2025

CVE-2025-62884 on NVD →

The Coupon Affiliates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcusage_generate_registration_page() function in versions up to, and including, 6.8.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to gen...

CVSS:

4.3

Affected:

up to 6.8.0

Fixed in:

6.8.1

Disclosed:

Sep 22, 2025

CVE-2025-59567 on NVD →

[en] Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Coupon Affiliates: from n/a through 6.4.0.

Affected:

up to 6.4.2

Fixed in:

6.4.2

Disclosed:

Aug 20, 2025

CVE-2025-54025 on NVD →

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.4.1. This makes it possible for unauthenticated attackers to update the plugin's settings.

CVSS:

5.3

Affected:

up to 6.4.1

Fixed in:

6.4.2

Disclosed:

Aug 6, 2025

CVE-2025-54025 on NVD →

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized actio...

CVSS:

4.3

Affected:

up to 6.4.0

Fixed in:

6.4.1

Disclosed:

Jul 16, 2025

CVE-2025-54022 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates allows Cross Site Request Forgery. This issue affects Coupon Affiliates: from n/a through 6.4.0.

Affected:

up to 6.4.1

Fixed in:

6.4.1

Disclosed:

Jul 16, 2025

CVE-2025-54022 on NVD →

The Coupon Affiliates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.2.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 7.2.0

Fixed in:

7.2.1

Disclosed:

Jun 25, 2025

CVE-2025-62884 on NVD →

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commission_summary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVSS:

6.1

Affected:

up to 6.3.0

Fixed in:

6.3.1

Disclosed:

Apr 17, 2025

CVE-2025-3598 on NVD →

[en] The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.16.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This...

Affected:

up to 5.16.7.2

Fixed in:

5.16.7.2

Disclosed:

Dec 13, 2024

CVE-2024-12421 on NVD →

The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.16.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes...

CVSS:

6.5

Affected:

up to 5.16.7.1

Fixed in:

5.16.7.2

Disclosed:

Dec 12, 2024

CVE-2024-12421 on NVD →

[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....

Affected:

up to 4.16.4

Fixed in:

4.16.4

Disclosed:

Oct 16, 2024

CVE-2022-4974 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates allows Reflected XSS.This issue affects Coupon Affiliates: from n/a through 5.12.7.

Affected:

up to 5.12.8

Fixed in:

5.12.8

Disclosed:

Mar 19, 2024

CVE-2024-29125 on NVD →

The Coupon Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.12.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu...

CVSS:

6.1

Affected:

up to 5.12.7

Fixed in:

5.12.8

Disclosed:

Mar 16, 2024

CVE-2024-29125 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP WooCommerce Affiliate Plugin – Coupon Affiliates plugin <= 5.4.5 versions.

Affected:

up to 5.4.6

Fixed in:

5.4.6

Disclosed:

Aug 14, 2023

CVE-2023-30475 on NVD →

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 5.5.1.2

Fixed in:

5.5.1.3

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin plugin <= 5.4.3 versions.

Affected:

up to 5.4.4

Fixed in:

5.4.4

Disclosed:

Jun 26, 2023

CVE-2023-28992 on NVD →

The Coupon Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execu...

CVSS:

6.1

Affected:

up to 5.4.5

Fixed in:

5.4.6

Disclosed:

Apr 13, 2023

CVE-2023-30475 on NVD →

The Coupon Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wcu_coupons' parameter in versions up to, and including, 5.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...

CVSS:

7.2

Affected:

up to 5.4.3

Fixed in:

5.4.4

Disclosed:

Mar 31, 2023

CVE-2023-28992 on NVD →

[en] The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.

Affected:

up to 4.16.4.5

Fixed in:

4.16.4.5

Disclosed:

Mar 28, 2022

CVE-2022-0818 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 4.16.4

Fixed in:

4.16.4

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

Affected:

up to 4.16.4

Fixed in:

4.16.4

Disclosed:

Mar 4, 2022

The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.

CVSS:

7.2

Affected:

up to 4.16.4.5

Fixed in:

4.16.4.5

Disclosed:

Mar 2, 2022

CVE-2022-0818 on NVD →

Sensitive Information Disclosure vulnerability discovered in WordPress Coupon Affiliates plugin (versions < 4.16.4.5).

Affected:

up to 4.16.4.5

Fixed in:

4.16.4.5

Disclosed:

Feb 28, 2022

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Coupon Affiliates plugin (versions < 4.16.4.5).

Affected:

up to 4.16.4.5

Fixed in:

4.16.4.5

Disclosed:

Feb 28, 2022

The WooCommerce Affiliate Plugin – Coupon Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 4.11.3.4. This is due to missing or incorrect nonce validation on the delete_click_entry function. This makes it possible for unauthenticated attackers to arbitrarily delete referral...

CVSS:

8.8

Affected:

up to 4.11.3.4

Fixed in:

4.11.3.4

Disclosed:

Oct 11, 2021

The WooCommerce Affiliate Plugin – Coupon Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 4.11.3.4. This is due to missing or incorrect nonce validation on the delete_click_entry function. This makes it possible for unauthenticated attackers to arbitrarily delete referral...

Affected:

up to 4.11.3.4

Fixed in:

4.11.3.4

Disclosed:

Oct 11, 2021

The WooCommerce Affiliate Plugin – Coupon Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 4.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVSS:

6.1

Affected:

up to 4.11.0.1

Fixed in:

4.11.0.2

Disclosed:

Aug 24, 2021

The WooCommerce Affiliate Plugin – Coupon Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 4.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

Affected:

up to 4.11.0.2

Fixed in:

4.11.0.2

Disclosed:

Aug 24, 2021

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Coupon Affiliates plugin (versions <= 4.11.0.1).

Affected:

up to 4.11.0.2

Fixed in:

4.11.0.2

Disclosed:

Aug 24, 2021

Affected:

up to 6.3.1

Fixed in:

6.3.1

CVE-2025-3598 on NVD →

The plugin does not escape the page parameter in its Referral Visits dashboard before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Affected:

up to 4.11.0.2

Fixed in:

4.11.0.2

The plugin does not have any CSRF in place when deleting Referral Visits, which could allow attackers to make a logged in admin delete them via a CSRF attack

Affected:

up to 4.11.3.4

Fixed in:

4.11.3.4

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 5.6.0

Fixed in:

5.6.0

CVE-2023-33999 on NVD →