WordPress Plugin Vulnerabilities

Affiliates Manager < 2.9.21 - Cross-Site Request Forgery

Description

Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.

Affects Plugins

Plugin icon
affiliates-manager
Fixed in 2.9.21

References

CVE
CVE-2023-28986
URL
https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-20-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
minhtuanact
Verified
No
WPVDB ID
d668321a-b742-42d3-88b1-a06c72d5c5ae

Timeline

Publicly Published
2023-03-29 (about 3 years ago)
Added
2023-07-10 (about 2 years ago)
Last Updated
2023-07-10 (about 2 years ago)

Other

Published
Title
Published
2024-04-05
Title
Sign-up Sheets < 2.2.12 - Cross-Site Request Forgery
Published
2021-09-07
Title
Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting
Published
2025-06-27
Title
Twitch TV Embed Suite <= 2.1.0 - Cross-Site Request Forgery
Published
2025-12-25
Title
Vimeotheque < 2.3.6 - Cross-Site Request Forgery
Published
2021-06-30
Title
BuddyPress Customer.io Analytics Integration <= 1.1.6 - Arbitrary Plugin Settings Update via CSRF