WP Security CheckVulnerability data as of November 4, 2026

Known vulnerabilities in ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin

🔗 Affiliate link management & cloaker tool. Easily manage, shrink and track your affiliate links in WordPress. 🔥

7Reported vulnerabilities
7.2Highest CVSS score
3.12.0Latest version
30,000+Active installs

What to do now

Update ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin to 3.12.2 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 27, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-0398 Medium 5.4 0.3% Before 3.10.5 3.10.5 April 25, 2022
CVE-2021-24127 Medium 5.4 0.7% Before 3.9.3 3.9.3 March 18, 2021
CVE-2022-0634 Medium 4.3 0.3% Before 3.10.5 3.10.5 April 25, 2022
CVE-2026-119089 High 7.2 0.2% 0 to 3.12.1 (inclusive) 3.12.2 October 31, 2026
CVE-2025-67537 Medium 6.4 0.2% 3.11.8 and earlier 3.11.9 December 15, 2025
CVE-2026-97314 Medium 5.3 0.2% 3.12.0 and earlier 3.12.1 October 15, 2026
CVE-2026-25024 Medium 4.3 0.1% 3.11.9 and earlier 3.11.10 February 2, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.