---
id: "CVE-2026-119089"
kind: "vulnerability"
aliases: ["CVE-2026-119089"]
title: "ThirstyAffiliates WordPress plugin: stored script injection via comments"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "thirstyaffiliates", "fixed": ["3.12.2"], "affected": "<= 3.12.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["block-themes", "package", "thirstyaffiliates", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["classic-theme", "comments-disabled", "no-block-theme", "plugin-not-installed"]
published_at: "2026-10-31T07:16:36+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:35:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119089", "first_seen_at": "2026-10-31T07:34:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T07:35:49+00:00"}]
---

# ThirstyAffiliates WordPress plugin: stored script injection via comments

The ThirstyAffiliates WordPress plugin up to and including version 3.12.1 does not sanitize the comment parameter on block themes. An unauthenticated attacker can store scripts that run in the browser of any visitor who opens an affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:thirstyaffiliates affected <= 3.12.1 fixed 3.12.2

## How to check

- Check the installed ThirstyAffiliates version in the WordPress plugins screen or `wp plugin get thirstyaffiliates --field=version`
- Confirm whether the site uses a block theme such as Twenty Twenty-Five and whether the Comment Content block is used on pages

## Fix

Update ThirstyAffiliates to 3.12.2 or later (WPSec advisory; not confirmed on maintainer page)

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119089
- 2026-10-31T07:35:49+00:00 analyst — Fix is 3.12.2 (released 2026-10-29) per WPSec advisory and Patchstack listing 3.12.2 as latest. I could not read the maintainer's changelog or the svn tag, so nothing is marked verified. WPSec says the cause is the <ta> affiliate-link tag allowed by kses in comments; Wordfence's CVE text says block themes only. No exploitation or public PoC found.

## Documents

- [advisory] WPSEC-2026-2132 ThirstyAffiliates <= 3.12.1 stored XSS https://wpsec.com/vuln/WPSEC-2026-2132/
- [mentions] ThirstyAffiliates on WordPress.org https://wordpress.org/plugins/thirstyaffiliates/

## From the sources

The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_