CVE-2025-13624

Vulnerability

Overview The Overstock Affiliate Links plugin for WordPress, in all versions up to and including 1.1, contains a reflected cross-site scripting (XSS) vulnerability. The flaw resides in the plugin's handling of the $_SERVER['PHP_SELF'] parameter, where insufficient input sanitization and output escaping allow attackers to inject arbitrary web scripts [1].

Exploitation

Details An unauthenticated attacker can exploit this vulnerability by crafting a malicious link that includes a payload in the PHP_SELF parameter. The attack requires user interaction, as the victim must click on the crafted link. No authentication is needed, and the attack can be performed remotely over the network [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, or redirection to malicious sites. The CVSS v3 base score of 6.1 (Medium) reflects the need for user interaction requirement and the potential for partial impact on confidentiality and integrity [1].

Mitigation

The plugin has been closed as of December 16, 2025, and is no longer available for download due to this security issue. Users who have the plugin installed should remove it immediately and replace it with an alternative solution. No patched version is available [1].