{"id":"CVE-2026-119089","kind":"vulnerability","aliases":["CVE-2026-119089"],"related":[],"title":"ThirstyAffiliates WordPress plugin: stored script injection via comments","description":"The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.","summary":"The ThirstyAffiliates WordPress plugin up to and including version 3.12.1 does not sanitize the comment parameter on block themes. An unauthenticated attacker can store scripts that run in the browser of any visitor who opens an affected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"thirstyaffiliates","fixed":["3.12.2"],"affected":"<= 3.12.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["block-themes","package","thirstyaffiliates","wordpress","wordpress-plugin","xss"],"not_affected_if":["classic-theme","comments-disabled","no-block-theme","plugin-not-installed"],"how_to_check":"- Check the installed ThirstyAffiliates version in the WordPress plugins screen or `wp plugin get thirstyaffiliates --field=version`\n- Confirm whether the site uses a block theme such as Twenty Twenty-Five and whether the Comment Content block is used on pages","fix":"Update ThirstyAffiliates to 3.12.2 or later (WPSec advisory; not confirmed on maintainer page)","status":"open","published_at":"2026-10-31T07:16:36+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:28+00:00","updated_at":"2026-10-31T07:35:49+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-31T07:34:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ThirstyAffiliates WordPress plugin: stored script injection via comments","impact":"medium","summary":"The ThirstyAffiliates WordPress plugin up to and including version 3.12.1 does not sanitize the comment parameter on block themes. An unauthenticated attacker can store scripts that run in the browser of any visitor who opens an affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","thirstyaffiliates","block-themes"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Scripts run in visitors' browsers and can steal sessions or act as them","analyst_note":"Confirm the fixed plugin version and whether a patch exists; the sources given do not state one.","how_to_check":"- Check the installed ThirstyAffiliates version in the WordPress plugins screen or `wp plugin get thirstyaffiliates --field=version`\n- Confirm whether the site uses a block theme such as Twenty Twenty-Five and whether the Comment Content block is used on pages","plain_action":"","needs_analyst":true,"not_affected_if":["classic-theme","plugin-not-installed","comments-disabled"],"who_is_affected":"Sites running ThirstyAffiliates up to and including 3.12.1 on a block theme where the Comment Content block renders comments. The sources say an attacker must first have one comment approved, after which later crafted comments are auto-approved. Sites on classic themes or without the plugin are not described as affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4317,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version and whether a patch exists; the sources given do not state one.","search":"'-119089':11A,14A '-2026':10A,13A '3.12.1':35B,96C 'access':125C 'addit':161C 'affect':62B 'affili':66C 'approv':174C,183C 'arbitrari':114C 'attack':47B,111C,164C,167C 'auto':182C 'auto-approv':181C 'block':17B,43B,135C,147C,155C 'block-them':16B 'brand':69C 'browser':55B 'caus':148C 'comment':8A,40B,87C,145C,149C,173C,179C 'content':146C 'craft':178C 'cross':82C 'cross-sit':81C 'cve':9A,12A 'due':97C 'escap':104C 'execut':121C 'exploit':133C 'five':142C 'flow':152C 'html':150C 'includ':33B,95C 'inject':6A,113C,127C 'input':100C 'insuffici':99C 'link':67C,68C,70C 'make':106C 'market':72C 'one':171C 'open':60B 'output':103C 'packag':19B 'page':63B,118C,128C 'paramet':41B,88C 'plugin':3A,24B,29B,73C,74C,158C 'possibl':108C 'prior':172C 'public':186C 'render':154C,185C 'requir':165C 'run':52B 'sanit':38B,101C 'script':5A,50B,84C,116C 'site':83C 'store':4A,49B,80C 'subsequ':177C 'success':163C 'theme':18B,44B,136C 'thirstyaffili':1A,20B,27B,65C 'thirstyaffiliates':15A 'track':71C 'transform':160C 'trigger':156C 'twenti':139C,141C 'twenty-f':140C 'unauthent':46B,110C 'user':124C 'version':34B,91C 'via':7A,85C 'visitor':58B 'vulner':78C,130C 'web':115C 'whenev':122C 'wordpress':2A,21B,23B,28B,76C 'wordpress-plugin':22B 'xss':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running ThirstyAffiliates up to and including 3.12.1 on a block theme where the Comment Content block renders comments. The sources say an attacker must first have one comment approved, after which later crafted comments are auto-approved. Sites on classic themes or without the plugin are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119089","severity":null,"published_at":"2026-10-31T07:16:36+00:00","modified_at":"2026-10-31T07:16:36+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119089:1225","url":null,"severity":null,"published_at":"2026-10-31T07:35:49+00:00","modified_at":"2026-10-31T07:35:49+00:00","first_seen_at":"2026-10-31T07:35:49+00:00","fetched_at":"2026-10-31T07:35:49+00:00","note":"Fix is 3.12.2 (released 2026-10-29) per WPSec advisory and Patchstack listing 3.12.2 as latest. I could not read the maintainer's changelog or the svn tag, so nothing is marked verified. WPSec says the cause is the <ta> affiliate-link tag allowed by kses in comments; Wordfence's CVE text says block themes only. No exploitation or public PoC found."}],"documents":[{"id":30297,"url":"https://wpsec.com/vuln/WPSEC-2026-2132/","title":"WPSEC-2026-2132 ThirstyAffiliates <= 3.12.1 stored XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":30298,"url":"https://wordpress.org/plugins/thirstyaffiliates/","title":"ThirstyAffiliates on WordPress.org","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}