Skip to content
Noroxi

Coupon Affiliates – Affiliate Plugin for WooCommerce

woo-coupon-usage · plugin

Known security vulnerabilities for Coupon Affiliates – Affiliate Plugin for WooCommerce. Find out in seconds which version runs on your site with WP Lens.

11 known vulnerabilities

9 exploitable without logging in · latest Jun 15, 2026

Listed on wordpress.org · latest 8.6.0 · last updated Oct 1, 2026 · 5K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2026-49068subscriber+≤ 7.8.1

    WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability

    High 7.5

  • CVE-2026-40770unauthenticated · needs a click≤ 7.5.3

    WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2024-29125unauthenticated · needs a click≤ 5.12.7

    WordPress Coupon Affiliates plugin <= 5.12.7 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-54025unauthenticated≤ 6.4.0

    WordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change Vulnerability

    Medium 6.5

  • CVE-2025-54022unauthenticated · needs a click≤ 6.4.0

    WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Medium 6.5

  • CVE-2024-12421unauthenticated≤ 5.16.7.1

    Coupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting

    Medium 6.5

  • CVE-2025-3598unauthenticated · needs a click≤ 6.3.0

    Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter

    Medium 6.1

  • CVE-2023-30475unauthenticated · needs a click≤ 5.4.5

    WordPress Coupon Affiliates Plugin <= 5.4.5 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-28992unauthenticated · needs a click≤ 5.4.3

    WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2025-59567high privilege≤ 6.8.0

    WordPress Coupon Affiliates Plugin <= 6.8.0 - Broken Access Control Vulnerability

    Medium 5.5

  • CVE-2025-62884unauthenticated≤ 7.2.0

    WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability

    Medium 5.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory