CVE-2026-19573

HighCVSS 7.2/10Last modified Sep 1, 2026

Description

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-195747.0The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_ini CVE-2026-195757.8The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argumen CVE-2026-195766.8The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it CVE-2026-195777.1net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without fi CVE-2026-195795.4Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoin CVE-2026-19588.7Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Cr CVE-2026-195839.9Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arb CVE-2026-195847.7Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup,CVE-2026-195855.3HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directo CVE-2026-195869.8A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due CVE-2026-195876.5Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation.CVE-2026-195886.5Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.