WordPress Auto Affiliate Links Plugin Stored XSS Flaw

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input sanitization on the 'url' POST parameter in the aal_url_stats_save_action() function and a complete absence of output escaping in aal_display_clicks(), where the stored value is echoed directly into an anchor element's href attribute and inner text without esc_url(), esc_attr(), or esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the admin statistics page that execute in an administrator's browser when the page is visited, leveraging a publicly exposed nonce and an unauthenticated AJAX endpoint registered via the wp_ajax_nopriv_ hook.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Auto Affiliate Links plugin for WordPress contains a critical stored cross-site scripting (XSS) vulnerability in versions up to 6.8.8. The flaw exists in the aal_url_stats_save_action() function, which fails to properly sanitize the 'url' POST parameter before storage. When this data is later displayed through the aal_display_clicks() function, it is echoed directly into HTML without proper escaping (missing esc_url(), esc_attr(), or esc_html() calls). This allows unauthenticated attackers to inject malicious JavaScript that persists in the database and executes in the browsers of all users viewing the affected content. WordPress site administrators and end-users are at risk, as the stored payload can steal session tokens, redirect users to malicious sites, or perform unauthorized actions on behalf of victims.

Casky's 301 mapped skills leverage Claude's extended reasoning to detect the attack patterns associated with MITRE techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). When analyzing this vulnerability, practitioners would identify detection signatures around suspicious POST requests to aal_url_stats_save_action() containing script tags or encoded payloads in the 'url' parameter, as well as monitoring for unusual href attribute modifications in database queries. Casky's skill set enables security teams to recognize both the input validation bypass (CWE-79 indicator) and the output encoding gap—key precursors to successful exploitation. Practitioners would see alerts for unescaped variable references in plugin code, anomalous database write patterns from untrusted sources, and subsequent page rendering with injected script content, enabling rapid remediation before widespread compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7330.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-7330

Casky has 301 skills that investigate the attack patterns behind CVE-2026-7330. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn