CVE-2026-7330: WordPress Auto Affiliate Links XSS Flaw

CVE-2026-7330 Overview

CVE-2026-7330 is a stored Cross-Site Scripting (XSS) vulnerability in the Auto Affiliate Links plugin for WordPress, affecting all versions up to and including 6.8.8. The flaw exists in the aal_url_stats_save_action() function, which insufficiently sanitizes the url POST parameter, and in aal_display_clicks(), which echoes the stored value into an anchor element without output escaping. Unauthenticated attackers can inject arbitrary JavaScript that executes in an administrator's browser when the admin statistics page is viewed. The vulnerability is reachable through the wp_ajax_nopriv_ AJAX endpoint and a publicly exposed nonce. The flaw is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in an administrator's browser session, enabling account takeover, plugin tampering, and persistent site compromise.

Affected Products

Auto Affiliate Links plugin for WordPress, versions up to and including 6.8.8
Plugin file aal_stats.php containing aal_url_stats_save_action() and aal_display_clicks()
Fixed in version 6.8.8.1 per the WordPress Plugin Version Change

Discovery Timeline

2026-05-08 - CVE-2026-7330 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-7330

Vulnerability Analysis

The vulnerability stems from two compounding failures in the plugin's click statistics handling. First, the aal_url_stats_save_action() function stores attacker-supplied content from the url POST parameter without performing adequate sanitization. Second, the aal_display_clicks() function renders that stored value directly into the admin statistics page without any output escaping. The plugin omits esc_url(), esc_attr(), and esc_html() when emitting the value into both the href attribute and inner text of an anchor element. This produces a classic stored XSS sink reachable from an unauthenticated source.

Root Cause

The root cause is missing input sanitization combined with absent context-aware output escaping, classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. WordPress provides dedicated escaping helpers for each output context, but the affected code paths in aal_stats.php bypass them entirely. References to the vulnerable lines are documented in the WordPress Plugin Code Reference at lines 225, 278, and 304.

Attack Vector

The AJAX endpoint is registered via the wp_ajax_nopriv_ hook, which exposes the action to unauthenticated requests. A nonce intended to gate the action is rendered publicly on front-end pages, allowing any visitor to retrieve it and submit a forged POST request. The attacker submits a crafted url value containing JavaScript, which the plugin stores in its statistics table. When an administrator later visits the click statistics page, the payload executes within the authenticated admin session. Full technical analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-7330

Indicators of Compromise

Unexpected POST requests to admin-ajax.php with action=aal_url_stats_save originating from unauthenticated clients
Rows in the plugin's statistics table where the url column contains <script>, javascript:, onerror=, or other HTML/JS syntax
New or unexpected administrator accounts, modified plugin/theme files, or injected backdoor PHP shortly after admin sessions
Outbound HTTP requests from admin browsers to attacker-controlled domains immediately after viewing the plugin's statistics page

Detection Strategies

Inspect wp_options, plugin database tables, and the aal_* tables for stored values containing HTML or script syntax
Review web server access logs for unauthenticated POSTs targeting the aal_url_stats_save AJAX action
Deploy a Web Application Firewall (WAF) rule that blocks url parameter values containing <, >, or javascript: schemes for this endpoint

Monitoring Recommendations

Alert on creation of new WordPress administrator accounts and unexpected changes to user roles
Monitor file integrity for wp-content/plugins/, wp-content/themes/, and wp-content/mu-plugins/ directories
Log and review all admin-session-originated requests to external domains for signs of credential or cookie exfiltration

How to Mitigate CVE-2026-7330

Immediate Actions Required

Update the Auto Affiliate Links plugin to version 6.8.8.1 or later immediately
Audit the plugin's statistics tables and purge any rows containing HTML or script syntax in the url column
Rotate administrator passwords and invalidate active sessions for all WordPress administrators
Review recent administrator activity, plugin changes, and added users for signs of compromise

Patch Information

The vendor released version 6.8.8.1 to address this vulnerability. The fix is documented in the WordPress Plugin Changeset 3519003, which adds proper input sanitization to the aal_url_stats_save_action() function and applies esc_url(), esc_attr(), and esc_html() in aal_display_clicks() before rendering stored values.

Workarounds

Deactivate the Auto Affiliate Links plugin until version 6.8.8.1 can be installed
Block external POST requests to admin-ajax.php with action=aal_url_stats_save at the WAF or reverse proxy layer
Restrict access to /wp-admin/ to known administrator IP addresses to limit payload trigger surface

bash

# Example WAF/nginx rule to block the unauthenticated AJAX action until patched
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "aal_url_stats_save") { return 403; }
    if ($request_method = POST) {
        # additionally inspect body for the action parameter at the WAF layer
    }
}