WordPress Plugin Vulnerabilities

Auto Amazon Links < 5.1.2 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
amazon-auto-links
Fixed in 5.1.2

References

CVE
CVE-2023-52175
URL
https://patchstack.com/database/vulnerability/amazon-auto-links/wordpress-auto-amazon-links-amazon-associates-affiliate-plugin-5-0-5-auth-stored-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Nguyen Anh Tien
Verified
No
WPVDB ID
1c8cbd50-456a-4d4d-a236-b54c13bdd0c8

Timeline

Publicly Published
2023-12-29 (about 2 years ago)
Added
2024-01-05 (about 2 years ago)
Last Updated
2024-01-10 (about 2 years ago)

Other

Published
Title
Published
2026-04-20
Title
Website LLMs.txt < 8.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2025-10-02
Title
Ultra Addons Lite for Elementor < 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field
Published
2024-10-17
Title
Advanced Category and Custom Taxonomy Image < 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode
Published
2025-04-14
Title
Import from YML < 4.0.0 - Reflected Cross-Site Scripting
Published
2024-05-02
Title
Flattr <= 1.2.2 - Admin+ Stored XSS