Post Affiliate Pro
Post Affiliate Pro has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 4.1, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF).
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
2 independent researchers contributed these findings, one record each. Post Affiliate Pro is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-2290Post Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
Read the full analysisVulnerability Records
Post Affiliate Pro
Author
qusupport
This plugin integrates Post Affiliate Pro – affiliate software into any WordPress installation. Post Affiliate Pro is an award-winning affiliate software with complete set of affiliate marketing features. Sell more with the best affiliate software.Post Affiliate Pro is the most Reviewed and #1 Rated affiliate software based on 300+ reviews on 3 independent software marketplaces & review platforms. You can rely on bullet-proof click, sale and action tracking technology which combines multiple tracking methods into one powerful tracking system. Promotional video You can find more info about Post Affiliate Pro here. Supported features: Integrates WordPress user signup with Post Affiliate Pro signup Integrates Post Affiliate Pro click tracking into WordPress Includes Top affiliates widget with basic affiliate statistics Shortcodes for affiliates Integration with Accept Stripe Payments Integration with Contact Form 7 (http://contactform7.com/) till version 3 (not included) Integration with Easy Digital Downloads Integration with LifterLMS Integration with Marketpress Integration with MemberPress Integration with Membership 2 Pro Integration with Post Membership Pro Integration with Restrict Content Pro Integration with WishList Member Integration with WooCommerce Integration with WooCommerce Autoship Integration with WooCommerce FunnelKit Integration with WooCommerce Subscriptions Integration with WooCommerce RevCent Integration with WP EasyCart Integration with WPPayForms Integration with WP Simple Pay Pro Also works with S2Member and Stripe Payments plugin Arbitrary section If you have any thoughts how to make this plugin better, do not hesitate to leave your ideas in plugin forum, or write an email to support@postaffiliatepro.com
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C