CVE-2026-40770
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Versions of Coupon Affiliates <= 7.5.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the application's security and its users.
Recommendation
It is recommended to update to the latest version of Coupon Affiliates to mitigate this vulnerability. A security audit of the application should also be conducted.
Other vulnerabilities in Coupon Affiliates
See all- CVE-2026-49068High
Coupon Affiliates versions up to 7.8.1 have a vulnerability that allows the exposure of subscriber sensitive data.
- CVE-2025-62884Medium
The Coupon Affiliates plugin up to version 7.2.0 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
- CVE-2025-59567Medium
The Coupon Affiliates plugin up to version 6.8.0 contains a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS