SUMO Affiliates Pro

SUMO Affiliates Pro has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 3 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 7.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (25%). Other recurring categories include Deserialization Of Untrusted Data, Exposure Of Sensitive Information To An Unauthorized Actor.

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

4 independent researchers contributed these findings, one record each.

01234567891030.05.2025Today30.05.20259.8SUMO Affiliates Pro < 11.1.0 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 30.05.202504.11.20254.3SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure CVSS 4.3 · 04.11.202518.03.20268.1SUMO Affiliates Pro < 11.4.0 - Unauthenticated PHP Object Injection CVSS 8.1 · 18.03.202604.10.20267.2SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 04.10.2026

Strategic Overview

Avg CVSSHigh
7.4/ 10
Patch Coverage75%
Open

1

Fixed

3

Get automatic notifications for all SUMO Affiliates Pro vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-32575

SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C