CVE-2024-12334

CVE-2024-12334 concerns the WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress. Affected versions: all up to and including 2.4. Root cause: insufficient input sanitization and output escaping, enabling Reflected Cross-Site Scripting via any parameter. Impact: unauthenticated att...

CVE-2024-12336

CVE-2024-12336 affects WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress up to version 2.5.3, where a missing capability check in export_all_data allows authenticated users with Subscriber+ privileges to read sensitive affiliate data (PII). The vulnerability is confirmed by mul...

CVE-2024-12321

CVE-2024-12321 : The WC Affiliate WordPress plugin (versions up to 2.3.9) does not sanitize/escape a user-controlled parameter before echoing it in a page, enabling a reflected Cross-Site Scripting vulnerability. Impact is described as potentially actionable against high-privilege users such as a...