CVE-2026-65515

Unauthenticated Cross Site Scripting (XSS) vulnerabilities in AffiliateWP versions up to 2.35.0 allow attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, data theft, or defacement. Organizations using affected versions should prioritize patching this vulnerability to mitigate risks associated with unauthorized access and exploitation. Web application developers and security teams should assess their systems and implement necessary updates immediately.