CVE-2024-12334

CVE-2024-12334 concerns the WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress. Affected versions: all up to and including 2.4. Root cause: insufficient input sanitization and output escaping, enabling Reflected Cross-Site Scripting via any parameter. Impact: unauthenticated att...

CVE-2024-12336

CVE-2024-12336 affects WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress up to version 2.5.3, where a missing capability check in export_all_data allows authenticated users with Subscriber+ privileges to read sensitive affiliate data (PII). The vulnerability is confirmed by mul...

CVE-2024-12321

The WC Affiliate WordPress plugin (versions 2.3.9 and earlier ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape a parameter before it is outputted back to the page. This flaw could be exploited to target high-privilege users, such as admi...