CVE-2026-19573

The Affiliate Super Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'doCommentShortcode' function, affecting all versions up to 1.10.2. This flaw allows unauthenticated attackers to inject malicious scripts, which can execute in the context of users accessing compromised pages, potentially leading to data theft or session hijacking. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of exploitation.