WordPress Plugin Vulnerabilities
ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS
Description
The ThirstyAffiliates Affiliate Link Manager WordPress plugin was vulnerable to authenticated stored Cross-Site Scripting (XSS). An authenticated attacker, such as an author, could attach an image with malicious JavaScript as its title, which would be executed once viewed by an administrator user.
Proof of Concept
https://drive.google.com/file/d/1tFhSPnnzRSVLx-T0TwtHGbUTK63ib6xq/view
Affects Plugins
Fixed in version 3.9.3
References
Classification
Miscellaneous
Timeline
Publicly Published
2020-05-22 (about 2 years ago)
Added
2020-05-25 (about 2 years ago)
Last Updated
2021-01-21 (about 1 years ago)