CVE-2026-119089

Name of the Vulnerable Software and Affected Versions ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin versions prior to 3.12.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. This is exploitable on block themes where the Comment Content block processes HTML through the render block() function, triggering the plugin transformer. A successful attack requires the attacker to have one previously approved comment, allowing subsequent crafted comments to be auto-approved and rendered publicly.

Recommendations Update ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin to version 3.12.2 or later.