WordPress Plugin Vulnerabilities
ClickBank Affiliate Ads < 1.35 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Proof of Concept
Put the following payload in one of the plugin's settings (such as "Title" and "Your ClickBank Nickname"): " style=animation-name:rotation onanimationstart=alert(/XSS/)//
Affects Plugins
Fixed in version 1.35
References
Classification
Miscellaneous
Timeline
Publicly Published
2015-05-06 (about 7 years ago)
Added
2021-12-01 (about 9 months ago)
Last Updated
2022-04-11 (about 5 months ago)