ClickBank Affiliate Ads < 1.35 – Admin+ Stored Cross-Site Scripting | CVE 2015-20106 | Plugin Vulnerabilities

Description

The plugin does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

Proof of Concept

Put the following payload in one of the plugin's settings (such as "Title" and "Your ClickBank Nickname"): " style=animation-name:rotation onanimationstart=alert(/XSS/)//

Affects Plugins

clickbank-ads-clickbank-widget

Fixed in 1.35

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Kaustubh G. Padwad

Verified

Yes

WPVDB ID

907792c4-3384-4351-bb75-0ad10f65fbe1

Timeline

Publicly Published

2015-05-06 (about 10 years ago)

Added

2021-12-01 (about 4 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2022-07-04

Title

Booster for WooCommerce < 5.6.2 - Reflected Cross-Site Scripting

Published

2023-08-11

Title

ImageRecycle pdf & image compression < 3.1.12 - Reflected XSS

Published

2022-06-16

Title

Awin Data Feed < 1.8 - Reflected Cross-Site Scripting

Published

2024-05-20

Title

Move Addons for Elementor < 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Published

2025-01-06

Title

Binary MLM Woocommerce < 2.1 - Reflected Cross-Site Scripting via 'page'