thedark Auto Affiliate Links Plugin up to 6.8.8 on WordPress AJAX Endpoint aal_url_stats_save_action url cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in thedark Auto Affiliate Links Plugin up to 6.8.8 on WordPress. The impacted element is the function aal_url_stats_save_action of the component AJAX Endpoint. Executing a manipulation of the argument url can lead to cross site scripting. This vulnerability is registered as CVE-2026-7330. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in thedark Auto Affiliate Links Plugin up to 6.8.8 on WordPress. It has been declared as problematic. This vulnerability affects the function aal_url_stats_save_action of the component AJAX Endpoint. The manipulation of the argument url with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input sanitization on the 'url' POST parameter in the aal_url_stats_save_action() function and a complete absence of output escaping in aal_display_clicks(), where the stored value is echoed directly into an anchor element's href attribute and inner text without esc_url(), esc_attr(), or esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the admin statistics page that execute in an administrator's browser when the page is visited, leveraging a publicly exposed nonce and an unauthenticated AJAX endpoint registered via the wp_ajax_nopriv_ hook.

The weakness was published by Alfa Fakhrur Rizal Zaini. The advisory is available at wordfence.com. This vulnerability was named CVE-2026-7330 since 04/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 6.8.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-28540). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Advertising Software

Vendor

• thedark

Name

• Auto Affiliate Links Plugin

Version

• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.8.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion