CVE-2026-40770: WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected or stored cross-site scripting (XSS) in the WordPress Coupon Affiliates plugin (versions 7.5.3 and earlier) allows an unauthenticated remote attacker to inject malicious scripts into pages served to other users. The vulnerability is reachable over the network, requires no authentication, and is triggered when a victim visits or interacts with a crafted URL or page. Successful exploitation lets the attacker execute arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, or unauthorized actions taken on behalf of the victim. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress installation over the network; there is no local or physical access requirement.

• AuthenticationNot required

  No account or session is needed; the attack can be launched by any unauthenticated external party.

• Victim interactionRequired

  A logged-in user (typically an admin or affiliate user) must visit or interact with a crafted link or page for the injected script to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• The attacker executes arbitrary JavaScript in the victim's browser session, allowing theft of session cookies or authentication tokens.
• With a stolen session, the attacker can perform actions as the victim, including modifying affiliate settings or accessing restricted WordPress admin functions.
• Confidential data visible to the victim in the current browser context, such as affiliate earnings and referral records, is exposed to the attacker.
• The injected script can alter page content delivered to the victim, defacing the user interface or redirecting the victim to a malicious site.