615 matches found
EUVD-2026-60780
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355
Unauthenticated SQL injection affects Affiliates Manager plugin ≤2.9.53, allowing remote attackers to extract sensitive database data (CVSS 9.3 critical). Patchstack reports the flaw; no patch version or exploit details are provided in the documents. Upgrade to the latest plugin version once avai...
CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
SQL Injection vulnerability discovered by 20kilograma in WordPress Plugin Affiliates Manager versions = 2.9.53...
WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by 20kilograma in WordPress Plugin Affiliates Manager versions = 2.9.53...
CVE-2026-73358: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
PT-2026-77094
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
PT-2026-77096
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-15056: Improper Limitation of a Pathname to a Restricted Directory
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Threat actors linked to the Cl0p aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure i...
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The operators of the DevMan ransomware-as-a-service RaaS scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administere...
CVE-2026-57654
Affiliate Broken Access Control in Affiliates Manager = 2.9.49 versions...
CVE-2026-57654
CVE-2026-57654 affects the WordPress Affiliates Manager plugin ≤ 2.9.49, described as a Broken Access Control vulnerability. The connected documents consistently label the issue as “Affiliate Broken Access Control in Affiliates Manager
CVE-2026-57654 WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability
Affiliate Broken Access Control in Affiliates Manager = 2.9.49 versions...
CVE-2026-57654 WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability
Affiliate Broken Access Control in Affiliates Manager = 2.9.49 versions...
WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin Affiliates Manager versions = 2.9.49...