CVE-2015-20105 ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site Scripting

2021-12-0217:40:10

CWE-352

CWE-79

WPScan

www.cve.org

8.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.3%

JSON

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues

CNA Affected

[
  {
    "product": "ClickBank Affiliate Ads",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.20",
        "status": "affected",
        "version": "1.20",
        "versionType": "custom"
      }
    ]
  }
]