CVE-2022-0818 Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS

2022-03-2817:23:25

CWE-79

WPScan

www.cve.org

cve-2022-0818

coupon affiliates

unauthenticated stored xss

woocommerce affiliate plugin

wordpress plugin

EPSS

0.001

Percentile

45.7%

JSON

The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.

CNA Affected

[
  {
    "product": "WooCommerce Affiliate Plugin – Coupon Affiliates",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.16.4.5",
        "status": "affected",
        "version": "4.16.4.5",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/c43fabb4-b388-462c-adc4-c6b25af7043b

EPSS

0.001

Percentile

45.7%

JSON

Related for CVELIST:CVE-2022-0818