CVE-2026-19573

Name of the Vulnerable Software and Affected Versions Affiliate Super Assistent versions prior to 1.10.3

Description Insufficient input sanitization and output escaping in the doCommentShortcode() function allow unauthenticated attackers to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user accesses the affected page.

Recommendations Update the plugin to a version later than 1.10.2. As a temporary workaround, consider disabling the doCommentShortcode() function until the update is applied.