AA-Team Vulnerabilities and Affected Products
Vulnerabilities associated with Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer).
Products
Clear product- WZone9 vulnerabilities
- Premium Age Verification / Restriction for WordPress3 vulnerabilities
- Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)2 vulnerabilities
- Pro Bulk Watermark Plugin for WordPress2 vulnerabilities
- Woocommerce Envato Affiliates2 vulnerabilities
- Amazon Native Shopping Recommendations1 vulnerability
- Premium SEO Pack1 vulnerability
- Responsive Coming Soon Landing Page / Holding Page for WordPress1 vulnerability
- SearchAzon1 vulnerability
- Woocommerce Sales Funnel Builder1 vulnerability
- Wordpress Movies Bulk Importer1 vulnerability
- WZone – Lite Version1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-30631HIGH | Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress pluginsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder: from n/a through 1.1; Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2. CWE-79Jan 6, 2026 | CVSS7.1v3.1 | EPSS0.153% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-30628HIGH | WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection VulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2. CWE-89Dec 31, 2025 | CVSS8.5v3.1 | EPSS0.219% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |