CVE-2026-119089 in ThirstyAffiliates Plugin
Summary
by MITRE • 10/31/2026
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The ThirstyAffiliates WordPress plugin, specifically in versions up to 3.12.1, contains a critical stored cross-site scripting vulnerability within its affiliate link management functionality. This flaw stems from insufficient input sanitization and output escaping mechanisms when handling user-supplied data. The specific vector for exploitation is the comment parameter associated with blog posts or pages where comments are enabled. While many WordPress plugins handle comment content securely by stripping dangerous scripts, this particular plugin fails to adequately sanitize malicious JavaScript payloads embedded within comment text before storing them in the database. Consequently, any script injected into a comment field remains intact and executable when that comment is subsequently displayed on the frontend of the website.
The operational impact of this vulnerability is significant because it allows unauthenticated attackers to execute arbitrary web scripts in the context of any user who views an affected page. This type of attack falls under CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. The consequences can range from session hijacking and credential theft via cookie access to defacement of the website or redirection of users to malicious phishing sites. Since the script executes in the browser of the victim user, it inherits the same privileges as that user, potentially allowing attackers to perform actions on behalf of administrators if they have administrative roles, thereby compromising the entire WordPress installation.
A crucial technical nuance defines the exploitability conditions for this vulnerability: it is only effective against websites using block themes, such as Twenty Twenty-Five or other Gutenberg-based designs. In classic themes, comment content might be rendered differently, bypassing the specific code path that triggers the flaw. However, in block themes, the Comment Content block processes data through a function called render_block. This function invokes the plugin's internal transformer logic, which is where the lack of proper escaping becomes apparent. The transformer fails to neutralize script tags or event handlers before outputting them into the HTML structure, leading directly to execution upon page load by any visitor.
Furthermore, the attack chain requires a specific sequence of events that lowers the barrier for exploitation but still demands some level of initial access. An attacker must first submit a comment on an affected post and have it approved by a moderator or administrator. Once this initial comment is live and visible to users, subsequent crafted comments containing malicious scripts are automatically approved without further moderation checks due to how the plugin handles state after the first approval. This auto-approval mechanism ensures that once the foothold is established through the first valid injection point, additional payloads can be deployed rapidly to maximize impact or target specific high-value users who visit those pages frequently.
To mitigate this risk, site administrators should immediately update the ThirstyAffiliates plugin to a version later than 3.12.1 where these sanitization issues have been addressed by the developers. If updating is not immediately possible, temporary mitigations include disabling comments on high-traffic posts or restricting comment approval privileges to trusted users only. Additionally, implementing a Web Application Firewall can help filter out known malicious patterns in POST requests containing script tags before they reach the application logic. From a defensive posture perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 for command and scripting interpreter abuse via web browsers, highlighting the need for robust input validation and output encoding strategies in all user-facing forms within WordPress environments.