CVE-2026-65515 describes an unauthenticated Cross Site Scripting (XSS) vulnerability affecting AffiliateWP versions up to 2.35.0. The vulnerability allows remote attackers to inject malicious scripts that execute in the context of users interacting with the affected application. The CVSS v3.1 vector indicates the attack can be performed remotely without privileges (AV:N/AC:L/PR:N), requires user interaction (UI:R), and impacts confidentiality, integrity, and availability to a limited extent (C:L/I:L/A:L). No specific technical details or exploitation methods are provided beyond the classification as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability does not require authentication, increasing the attack surface. However, user interaction is required to trigger the exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider applying web application firewalls or input validation controls if feasible to mitigate exploitation risk.