Affiliates Manager

Affiliates Manager has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 16 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 9.0 out of 10. Severity breakdown: 1 critical and 6 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 5 of the records (31%). Other recurring categories include Cross-Site Scripting, SQL Injection.

Every one of the 16 issues recorded for Affiliates Manager has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (2) reported by 20kilograma. Affiliates Manager is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891005.06.2014Today26.05.20198.8Affiliates Manager <= 2.6.5 - Cross-Site Request Forgery CVSS 8.8 · 26.05.201911.09.20206.1Affiliates Manager <= 2.7.7 - Cross-Site Scripting CVSS 6.1 · 11.09.202011.10.20217.2Affiliate Manager <= 2.8.6 - Admin+ SQL injection CVSS 7.2 · 11.10.202124.12.20217.2Affiliates Manager <= 2.8.9 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 24.12.202116.08.20225.5Affiliates Manager <= 2.9.13 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 5.5 · 16.08.20229.0Affiliates Manager <= 2.9.13 - CSV Injection CVSS 9.0 · 16.08.20228.8Affiliates Manager <= 2.9.13 - Cross-Site Request Forgery CVSS 8.8 · 16.08.20226.1Affiliates Manager <= 2.9.13 - Reflected Cross-Site Scripting CVSS 6.1 · 16.08.202229.03.20234.3Affiliates Manager <= 2.9.20 - Cross-Site Request Forgery via process_bulk_action() CVSS 4.3 · 29.03.202328.12.20236.5Affiliates Manager <= 2.9.31 - Cross-Site Request Forgery via multiple AJAX actions CVSS 6.5 · 28.12.20235.3Affiliates Manager <= 2.9.30 - Sensitive Information Exposure via Log File CVSS 5.3 · 28.12.202330.01.20244.3Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery CVSS 4.3 · 30.01.202408.06.20265.3Affiliates Manager <= 2.9.50 - Unauthenticated Information Exposure CVSS 5.3 · 08.06.202626.06.20264.3Affiliates Manager <= 2.9.49 - Missing Authorization CVSS 4.3 · 26.06.202618.08.20267.5Affiliates Manager <= 2.9.53 - Unauthenticated SQL Injection CVSS 7.5 · 18.08.20267.2Affiliates Manager <= 2.9.53 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 18.08.2026

Strategic Overview

Avg CVSSMedium
6.5/ 10
Patch Coverage100%
Open

0

Fixed

16

Get automatic notifications for all Affiliates Manager vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.0CVE-2022-2798

Affiliates Manager <= 2.9.13 - CSV Injection

Read the full analysis

Vulnerability Records

16 records
2026-08-18 00:00CVE-2026-73355
7.5
High
20kilogramaYes
2026-08-18 00:00CVE-2026-73358
7.2
High
20kilogramaYes
2026-06-26 00:00CVE-2026-57654
4.3
Medium
Jakub HermanYes
2026-06-08 00:00CVE-2026-52692
5.3
Medium
dodoh4tYes
2024-01-30 00:00CVE-2024-0859
4.3
Medium
Nathaniel Oh (Calysteon)Yes
2023-12-28 00:00CVE-2023-52130
6.5
Medium
Brandon James Roldan (tomorrowisnew)Yes
2023-12-28 00:00CVE-2023-52148
5.3
Medium
Joshua ChanYes
2023-03-29 00:00CVE-2023-28986
4.3
Medium
minhtuanactYes
2022-08-16 00:00CVE-2022-2799
5.5
Medium
Kévin Mosbahi (Mika)Yes
2022-08-16 00:00CVE-2022-2798
9.0
Critical
Nhật NamYes
Showing 1–10 of 16 reports
Affiliates Manager banner
Latestv2.9.55

Affiliates Manager

wp.insider

Author

wp.insider

4.1(61)
82/100
Last Updated
2026-09-02 (11d ago)
Active Installs
8,000+
Downloads
1,067,467
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2014-06-05 (12y ago)

Running your WordPress site with an e-Commerce plugin or solution? WP Affiliate Manager can help you manage an affiliate marketing program to drive more traffic and more sales to your store. Affiliate Marketing is the fastest growing advertising method and it is very cost effective. This wp affiliate plugin facilitates the affiliates recruitment, registration, login, management process. It will also track the referrals your affiliates send to your site and give commissions appropriately. Affiliates Manager integrates with some popular e-commerce solutions. It integrates with: WooCommerce WooCommerce Subscriptions Simple Shopping Cart WP eCommerce JigoShop Easy Digital Downloads iThemes Exchange WP eStore Sell Digital Downloads Paid Membership Pro S2Member Simple Membership Stripe Payments Gravity Forms PayPal Gravity Forms Stripe WP Express Checkout OptimizeMember MemberMouse AppThemes LifterLMS WP Courseware MemberPress GiveWP Real-Time Reporting Your affiliate’s traffic and sales are recorded and ready for display as soon as they happen. Unlimited Affiliates No matter if you have 1 or 1,000 affiliates, you can track them all. Automatic Affiliate Approval Automatically approve newly registered affiliates so they can start promoting your products. Manual Affiliate Approval Do you want to work with selected affiliates? With the manual approval option you can approve/decline each affiliate application. Flat Rate or Percentage Based Payouts You decide how you want to reward your affiliates. You can choose to pay your affiliates a flat rate per order, or choose to pay them a percentage of every order they initiate. Set Payout Rates Per Affiliate Each of your affiliates can be set to their own payout amount. Manual Adjustments and Payouts There may be a time when you need to credit an affiliate for something other than a sale. For example, a bonus for reaching a sales goal. Manual adjustments are treated as a line item for easy tracking. Pay Your Affiliates Using PayPal Ability to easily pay your affiliates their commission using PayPal. Manual Payout Pay affiliates with your preferred method and mark them as paid in the plugin. Unlimited Creatives and Ads for your Affiliates You can add as many banners or text link ads as you wish. Plus, you can easily activate or deactivate creatives as needed. Customizable Affiliate Registration You can decide how much or how little data to collect from your affiliates when they sign up. You can mark each field as optional or required. Disable Own Referrals Prevent affiliates from earning commissions on their own purchases. Affiliate Registration Form Customization Customize the affiliate registration form with custom affiliate fields. Affiliate Coupon Tracking Link affiliate accounts to WooCommerce coupon codes and track them to reward commissions. Manual Referral Tracking Manually track a purchase and create a commission/referral record for it. Referral Link Generator Affiliates can generate their own referral links from the affiliate dashboard. Social Sharing Links Affiliates can generate links for your products that can be shared on social media. Set Cookie Duration Specify how long the referral cookie should be valid for (30 days by default). Autoresponder Integration Sign up affiliates to your Mailchimp list. Sign up affiliates to MailPoet newsletter list. Sign up affiliates to your AWeber list. Sign up affiliates to your Mad Mimi list. Sign up affiliates to your Infusionsoft account. Sign up affiliates to your GetResponse list. Sign up affiliates to your ActiveCampaign list. Affiliate Ad Impression Tracking Track how many times a particular affiliate ad is getting viewed. Customize Email for Affiliates You can customize the email that is sent to an affiliate after they register for an account. The following messages are customizable: HTML message displayed to user at logon if affiliate STATUS = APPROVED HTML message displayed to user at logon if affiliate STATUS = DECLINED HTML message displayed to user at logon if affiliate STATUS = PENDING HTML message displayed to user after successfully submitting the affiliate registration form Body of the e-mail sent to the affiliate immediately after submitting their application. Body of e-mail sent to the affiliate immediately following their application being declined. Body of e-mail sent to a newly registered affiliate immediately following their application being approved. Body of e-mail sent to the affiliate immediately after earning a commission. Body of e-mail sent to the admin when an affiliate earns a commission. Body of e-mail sent to a newly approved affiliate if they have an existing user account. Translation Ready This plugin can be translated to your language. The following language translations are already available in the plugin: English German French Hebrew Portuguese Spanish Bulgarian Finnish Dutch Italian Icelandic Polish You can translate the plugin using this documentation. Support View the Plugin Documentation to get started. If you have a question, you can ask it on our support forum. Visit the affiliate manager plugin site for more details. Developers If you are a developer and you need some extra hooks or filters for this plugin then let us know. Github repository – https://github.com/wp-insider/affiliates-manager-plugin Arbitrary section None

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C