CVE-2026-19573

CVE-2026-19573 is a stored cross-site scripting (XSS) flaw in the doCommentShortcode function of the Affiliate Super Assistent plugin for WordPress, present in all versions up to and including 1.10.2 because input is insufficiently sanitized and output is insufficiently escaped. An unauthenticated attacker can submit a crafted comment-shortcode payload that is stored by the site, and the injected web script then executes in the browser of any user who views the injected page. Successful exploitation allows arbitrary JavaScript to run in victims' sessions, which can be used to steal session cookies, perform actions as the victim (including administrators), or redirect users. Any WordPress site running Affiliate Super Assistent version 1.10.2 or earlier is affected. No exploitation is known: there is no public proof-of-concept, EPSS is low at 0.2% (15th percentile), and the vulnerability is not in CISA KEV.

What to do: Update the plugin to a version later than 1.10.2 as soon as a patched release is published (no fixed version number is specified in the available data, so check the WordPress plugin directory for the current update). Until patching, deactivate the plugin or apply vendor-recommended mitigations, and review site content for unexpectedly injected scripts. Because stored XSS payloads persist, administrators should also check for suspicious administrator accounts and recently modified posts or pages on affected sites.