Plugin icon

Coupon Affiliates – Affiliate Plugin for WooCommerce

woo-coupon-usage

Vulnerabilities:

16

Last Updated:

May 15, 2026

Active Installs:

5000

Published
Title
Fixed in
CVSS
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Fixed in
Fixed in 5.19.0
CVSS
7.1 (high)
Published
2026-04-21
Title
Coupon Affiliates – Affiliate Plugin for WooCommerce < 7.6.0 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 7.6.0
CVSS
7.2 (high)
Published
2025-09-22
Title
Coupon Affiliates < 6.8.1 - Missing Authorization
Fixed in
Fixed in 6.8.1
CVSS
4.3 (medium)
Published
2025-08-06
Title
Coupon Affiliates < 6.4.2 - Missing Authorization to Unauthenticated Settings Update
Fixed in
Fixed in 6.4.2
CVSS
5.3 (medium)
Published
2025-07-16
Title
Coupon Affiliates < 6.4.1 - Cross-Site Request Forgery
Fixed in
Fixed in 6.4.1
CVSS
4.3 (medium)
Published
2025-06-25
Title
Coupon Affiliates < 7.2.1 - Missing Authorization
Fixed in
Fixed in 7.2.1
CVSS
5.3 (medium)
Published
2025-04-17
Title
Coupon Affiliates – Affiliate Plugin for WooCommerce < 6.3.1 - Reflected Cross-Site Scripting via 'commission_summary' Parameter
Fixed in
Fixed in 6.3.1
CVSS
6.1 (medium)
Published
2024-12-12
Title
Coupon Affiliates – Affiliate Plugin for WooCommerce < 5.16.7.2 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting
Fixed in
Fixed in 5.16.7.2
CVSS
6.5 (medium)
Published
2024-03-16
Title
Coupon Affiliates < 5.12.8 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.12.8
CVSS
6.1 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.5.1.3
CVSS
6.1 (medium)
Published
2023-06-26
Title
Coupon Affiliates < 5.4.4 - Unauthenticated Reflected XSS
Fixed in
Fixed in 5.4.4
CVSS
7.1 (high)
Published
2023-04-13
Title
Coupon Affiliates < 5.4.6 - Reflected XSS
Fixed in
Fixed in 5.4.6
CVSS
7.1 (high)
Published
2022-03-02
Title
Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
Fixed in
Fixed in 4.16.4.5
CVSS
8.8 (high)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 4.16.4
CVSS
4.3 (medium)
Published
2021-10-11
Title
Coupon Affiliates for WooCommerce < 4.11.3.4 - Arbitrary Referral Visits Deletion via CSRF
Fixed in
Fixed in 4.11.3.4
CVSS
4.3 (medium)
Published
2021-08-24
Title
Coupon Affiliates for WooCommerce < 4.11.0.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.11.0.2
CVSS
7.1 (high)