WordPress Plugin Vulnerabilities

AffiliateWP <= 2.0.9 - Authenticated Cross-Site Scripting (XSS)

Description

The AffiliateWP WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
AffiliateWP
Fixed in 2.0.9.1

References

URL
https://www.defensecode.com/advisories/DC-2017-05-005_WordPress_AffiliateWP_Plugin_Advisory.pdf

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
Neven Biruski
Submitter website
http://www.defensecode.com
Submitter twitter
https://www.twitter.com/DefenseCode
Verified
No
WPVDB ID
e3ea30c6-eee6-409c-bd0a-ffd90dc94ac1

Timeline

Publicly Published
2017-05-24 (about 8 years ago)
Added
2017-05-26 (about 8 years ago)
Last Updated
2019-11-01 (about 6 years ago)

Other

Published
Title
Published
2016-04-13
Title
e-search <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2023-09-22
Title
Simple Cloudflare Turnstile < 1.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-09-30
Title
Move Addons for Elementor < 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2014-08-01
Title
Eunoia - Unspecified XSS
Published
2024-04-05
Title
ENL Newsletter <= 1.0.1 - Stored XSS via CSRF