Vulnerabilities and security researches forthirstyaffiliates thirstyaffiliates

Jun 07, 2024

CVE, Research URL: CVE-2022-0634
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Apr 25, 2022
Research Description: The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
Affected versions: max 3.10.5.
Status: vulnerable

CVE, Research URL: CVE-2021-24127
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Mar 18, 2021
Research Description: Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead to privilege escalation.
Affected versions: max 3.9.3.
Status: vulnerable

CVE, Research URL: CVE-2022-0398
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Apr 25, 2022
Research Description: The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
Affected versions: max 3.10.5.
Status: vulnerable

Jan 10, 2026

CVE, Research URL: CVE-2025-67537
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Dec 09, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Stored XSS.This issue affects ThirstyAffiliates: from n/a through <= 3.11.8.
Affected versions: max 3.11.9.
Status: vulnerable

Feb 27, 2026

CVE, Research URL: CVE-2026-25024
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Feb 03, 2026
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through <= 3.11.9.
Affected versions: max 3.11.10.
Status: vulnerable

Oct 19, 2026

CVE, Research URL: CVE-2026-97314
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Oct 17, 2026
Research Description: The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
Affected versions: max 3.12.1.
Status: vulnerable

Nov 01, 2026

CVE, Research URL: CVE-2026-119089
Home page URL: Security reports for ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Application: ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Date: Oct 31, 2026
Research Description: The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.
Affected versions: max 3.12.2.
Status: vulnerable