Affiliate Super Assistent
Affiliate Super Assistent has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 7.3 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).
Every one of the 4 issues recorded for Affiliate Super Assistent has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Affiliate Super Assistent is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2024-8478Affiliate Super Assistent <= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution
Read the full analysisVulnerability Records

Affiliate Super Assistent
Author
Timo Reith
Affiliate Super Assistent (ASA1) lets you easily integrate Amazon products into your WordPress pages. By using the template feature, you can present the products in different styles on different pages. All by using simple [asa] shortcodes. Usage guide For the complete range of functions, get ASA2. Find the latest news on the blog and check out the Step-by-step guide. Features: Make money with WordPress and Amazon’s affiliate program Supports Amazon Creators API Supports Amazon PA API 5.0 Utilizes the Amazon Product Advertising API to receive product data Ease of use with asa-Shortcode tags Lets you design your own product templates Supports all Amazon stores activated for the API / webservice: Australia (AU), Brazil (BR), Canada (CA), China (CN), Germany (DE), Spain (ES), France (FR), India (IN), Italy (IT), Japan (JP), Mexico (MX), United Kingdom (UK), USA (US) Use your Amazon Associate ID for making money Features collections. You can define and mangage sets of products as a collection an show them on a page with only one BBCode tag or just the latest added product in your sidebar Backend translation: supported so far are English, German, Spanish and Serbian. Contact me to help translate. Supports product preview layers (for US, UK and DE so far) New with version 0.9.5: Caching Speeds up your blog when adding many products to your posts! New with version 0.9.6: Parsing [asa] tags in user comments Since version 0.9.6 compatible with Amazons Product Advertising API changes by August 15, 2009 which require all requests to be authenticated using request signatures Version 0.9.7 supports customer reviews again! Version 0.9.11 brings AJAX mode (optional) for faster page load Error handling options Test section Support WP capabilities to manage the permissions to subpages Version 1.3 intoduces ASIN prefetching which significantly increases the speed of the side-loading process. Features of the Pro Version: Amazon Creators API with Multi-Marketplace Support Supports other Shops besides Amazon Create Amazon prodcuts without PA API Managed Templates Customizable Templates (without programming skills) Product Picker (Editor button) Single Image Feature Select an image from all available Amazon product images Product Repository (speed up your site!) Parallel use of all Amazon stores Manage multiple Associate IDs in sets Powerful template syntax (Conditions…) Internationalization (Geolocation) Bestseller lists Email notifications Translated Templates Multiple caches Cronjobs HTTPS ready SEO ready ASA2 Pro is backwards compatible and comes with a Migration Wizard. Credits: Thanks for translations Serbian: Ogi Djuraskovic (http://firstsiteguide.com/) Spanish: Andrew Kurtis (http://www.webhostinghub.com/) Russian: Ivanka French: Marie-Aude (http://www.lumieredelune.com/) Help me translate ASA in your language. Get in contact Configuration Go to the new option page Affiliate Super Assistent (ASA1). On the Setup panel you can set your Amazon Access Key ID and Secret Access Key. Here you can find a detailed documentation: www.wp-amazon-plugin.com/guide/ Info If you find any bugs please send me a mail (support@NOSPAM_wp-amazon-plugin.com, remove the NOSPAM_) or use the comments on the plugin’s homepage. Please also contact me for feature requests and ideas how to improve this plugin. Any other reactions are welcome too of course.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C