CVE-2026-7330

The Auto Affiliate Links plugin for WordPress contains a security flaw affecting versions up to 6.8.8. Specifically, inadequate filtering of user input in the 'url' field within the aal_url_stats_save_action() function allows malicious scripts to be stored on the server. Furthermore, these scripts are then displayed directly in an HTML anchor tag without proper encoding, enabling unauthenticated attackers to inject arbitrary web content into the admin statistics page that executes when viewed by an administrator.

Based on public CVE data (MITRE/NVD).