PT-2025-47683 · WordPress · Affiliate Ai Lite

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-11799

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Affiliate AI Lite plugin for WordPress versions through 1.0.1

Description The Affiliate AI Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs due to inadequate input sanitization and output escaping in the 'asin' shortcode attribute within the affiai img shortcode. Authenticated attackers possessing contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute each time a user accesses the compromised page.

Recommendations Update Affiliate AI Lite plugin to a version beyond 1.0.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11799

Affected Products

Affiliate Ai Lite

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11799 · Security Note
• https://twitter.com/CVEnew/status/1991776205952151834 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399153%40affiliate-ai-lite&new=3399153%40affiliate-ai-lite · Note
• https://plugins.trac.wordpress.org/browser/affiliate-ai-lite/tags/1.0.1/includes/afx-img.php#L53 · Note
• https://twitter.com/VulmonFeeds/status/1991847399468249529 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b05f4ef4-aa64-4cf4-a278-604df8407d12?source=cve · Note