PLUGIN SECURITY
Known vulnerabilities, PHP compatibility and safer alternatives for the Aawp WordPress plugin — checked against WP Clinic's local security database.
aawpad manageradsadsenseaffiliateamazon
2 known CVEs on file for Aawp. Reported between 2022 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-50970 | AAWP [aawp] <= 3.16 (unfixed) | — | Medium 5.4 | < 3.16 | 3.16 | 2026-05-10 | — |
| CVE-2022-4794 | AAWP [aawp] < 3.12.3 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 3.12.3 | 3.12.3 | 2023-01-04 | — |
| — | AAWP [aawp] < 3.17.1 | — | Unknown | < 3.17.1 | 3.17.1 | 2022-01-05 | — |
| — | AAWP [aawp] < 3.17.1 | — | Unknown | < 3.17.1 | 3.17.1 | 2022-01-04 | — |
| — | AAWP [aawp] < 3.17.1 | — | Unknown | < 3.17.1 | 3.17.1 | — | — |
WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the tab parameter. Attackers can craft URLs with XSS payloads in the tab parameter of the aawp-settings admin page to execute arbitrary JavaScript in the context of authenticated users.
Source: CVE.org
The Amazon Affiliate plugin for WordPress is vulnerable to Reflected File Download via image proxy in versions up to, and including, 3.12.2. This makes it possible for unauthenticated attackers to abuse trusted domains to load malicious files from external sources.
Source: Wordfence
Reflected Cross-Site Scripting (XSS) vulnerability discovered by Andrea Bocchetti in WordPress AAWP premium plugin (versions <= 3.16).
Source: Patchstack
The Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Source: Wordfence
The plugin does not sanitise and escape the tab parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Source: WPScan
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.