ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS
Description
The ThirstyAffiliates Affiliate Link Manager WordPress plugin was vulnerable to authenticated stored Cross-Site Scripting (XSS). An authenticated attacker, such as an author, could attach an image with malicious JavaScript as its title, which would be executed once viewed by an administrator user.
Proof of Concept
https://drive.google.com/file/d/1tFhSPnnzRSVLx-T0TwtHGbUTK63ib6xq/view
Affects Plugins
Fixed in version 3.9.3✓
Classification
Miscellaneous
Timeline
Publicly Published
2020-05-22 (about 1 years ago)
Added
2020-05-25 (about 1 years ago)
Last Updated
2021-01-21 (about 10 months ago)