WordPress Plugin Vulnerabilities

Affiliates Manager < 2.9.14 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape parameters before outputting them back in pages, which could lead to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
affiliates-manager
Fixed in 2.9.14

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
2e2faa0d-a751-404a-ae15-e0fafc824bc0

Timeline

Publicly Published
2022-08-16 (about 3 years ago)
Added
2022-08-16 (about 3 years ago)
Last Updated
2022-08-16 (about 3 years ago)

Other

Published
Title
Published
2025-03-12
Title
MicroPayments < 3.2.5 - Reflected Cross-Site Scripting
Published
2024-05-06
Title
Yoast SEO < 22.6 - Reflected Cross-Site Scripting
Published
2022-07-18
Title
Name Directory < 1.25.5 - Stored Cross-Site Scripting via CSRF
Published
2025-04-14
Title
CRUDLab Scroll to Top <= 1.0.1 - Reflected Cross-Site Scripting
Published
2022-12-06
Title
WP Smart Import < 1.0.3 - Reflected Cross-Ste Scripting