CVE-2026-7330: WordPress Auto Affiliate Links Plugin Stored XSS

The National Vulnerability Database has identified CVE-2026-7330, a high-severity (CVSS 7.2) Stored Cross-Site Scripting (XSS) vulnerability in the Auto Affiliate Links plugin for WordPress, affecting versions up to and including 6.8.8. This flaw stems from inadequate input sanitization on the ‘url’ POST parameter within the aal_url_stats_save_action() function and a complete lack of output escaping in aal_display_clicks().

This critical oversight allows unauthenticated attackers to inject arbitrary web scripts into the admin statistics page. The exploit leverages a publicly exposed nonce and an unauthenticated AJAX endpoint registered via the wp_ajax_nopriv_ hook. When an administrator visits the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, data theft, or further compromise of the WordPress site.

Attackers’ calculus here is simple: target the widely used WordPress ecosystem, exploit a common vulnerability class (XSS), and gain unauthenticated access to execute code in an admin context. This is a low-effort, high-impact attack vector against a popular plugin.