CVE-2025-13859

Name of the Vulnerable Software and Affected Versions AffiliateX – Amazon Affiliate Plugin versions 1.0.0 through 1.3.9.3

Description The AffiliateX – Amazon Affiliate Plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the save customization settings AJAX action. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary JavaScript code that will execute when an AffiliateX block is rendered on a website.

Recommendations Update AffiliateX – Amazon Affiliate Plugin to a version later than 1.3.9.3.