WordPress Plugin Vulnerabilities

ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS

Description

The ThirstyAffiliates Affiliate Link Manager WordPress plugin was vulnerable to authenticated stored Cross-Site Scripting (XSS). An authenticated attacker, such as an author, could attach an image with malicious JavaScript as its title, which would be executed once viewed by an administrator user.

Proof of Concept

Affects Plugins

Plugin icon
thirstyaffiliates
Fixed in 3.9.3

References

CVE
CVE-2021-24127
URL
https://plugins.trac.wordpress.org/changeset/2310320/thirstyaffiliates

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.6 (medium)

Miscellaneous

Original Researcher
minhtuanact
Verified
Yes
WPVDB ID
1fbd9f7a-6f99-45a2-9d57-01631a1f35d6

Timeline

Publicly Published
2020-05-22 (about 5 years ago)
Added
2020-05-25 (about 5 years ago)
Last Updated
2021-01-21 (about 4 years ago)

Other

Published
Title
Published
2022-01-25
Title
AP Custom Testimonial < 1.4.8 - Reflected Cross-Site Scripting
Published
2019-04-30
Title
Share This Image <= 1.19 - Stored XSS
Published
2024-06-11
Title
Divi Torque Lite – Divi Theme and Extra Theme < 4.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
Published
2023-06-12
Title
Elementor Forms Google Sheet Connector < 1.0.7 - Reflected XSS
Published
2024-02-01
Title
ProfilePress < 4.14.4 - Contributor+ Stored XSS