CVE-2021-25078

🗓️ 24 Jan 2022 08:01:25Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 79 Views🌐 WEB

The Affiliates Manager WordPress plugin before 2.9.0 allows unauthenticated attackers to perform Cross-Site Scripting attacks

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2021-25078	24 Jan 202208:15	–	attackerkb
Circl	CVE-2021-25078	27 Apr 202309:58	–	circl
CNNVD	WordPress plugin 跨站脚本漏洞	24 Jan 202200:00	–	cnnvd
CNVD	WordPress affiliate Manager WordPress plugin cross-site scripting vulnerability	26 Jan 202200:00	–	cnvd
Cvelist	CVE-2021-25078 Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting	24 Jan 202208:01	–	cvelist
EUVD	EUVD-2021-11990	7 Oct 202500:30	–	euvd
Nuclei	Affiliates Manager < 2.9.0 - Cross Site Scripting	16 Aug 202619:27	–	nuclei
NVD	CVE-2021-25078	24 Jan 202208:15	–	nvd
OpenVAS	WordPress Affiliates Manager Plugin < 2.9.0 XSS Vulnerability	17 Feb 202300:00	–	openvas
OSV	CVE-2021-25078	24 Jan 202208:15	–	osv

NVD

Vulners

Node

wpaffiliatemanager affiliates_managerRange<2.9.0wordpress

[
  {
    "product": "Affiliates Manager",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.9.0",
        "status": "affected",
        "version": "2.9.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e
plugins	www.plugins.trac.wordpress.org/changeset/2648196

Parameter	Position	Path	Description	CWE
wpam_id	query param	/?wpam_id=1	XSS via unvalidated IP address in logs triggered by wpam_id parameter	CWE-79
X-Forwarded-For	header	/wp-admin/admin.php?page=wpam-clicktracking	XSS via unvalidated X-Forwarded-For header when admin views the click tracking page	CWE-79

17 Jun 2026 03:41Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.02288

CWE-79