CVE-2024-5284

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to Stored XSS via CSRF . The root cause is a lack of CSRF checks in certain areas combined with missing sanitization and escaping . This allows an attacker to perform a CSRF attack to force a logged-in administ...

CVE-2024-5281

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVE-2022-3898

CVE-2022-3898 affects the WordPress WP Affiliate Platform plugin (versions up to 6.3.9). The root cause is missing or incorrect nonce validation on multiple functions, including the affiliates_menu method, enabling CSRF. This can allow unauthenticated attackers to delete affiliate records by tric...

CVE-2024-5282

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVE-2024-5280

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to a Cross-Site Scripting (XSS) attack. The root cause is a combination of missing CSRF checks , lack of proper sanitization , and missing escaping in specific areas of the plugin. This flaw could allow an unau...

CVE-2022-3896

The CVE-2022-3896 entry concerns the WP Affiliate Platform plugin for WordPress. A Reflected Cross-Site Scripting vulnerability exists via the $_SERVER["REQUEST_URI"] parameter in versions up to and including 6.3.9, caused by insufficient input sanitization and output escaping. This allows unauth...

CVE-2024-5286

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVE-2024-5287

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack

CVE-2024-5285

The wp-affiliate-platform WordPress plugin (versions prior to 6.5.2 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when deleting affiliates. This vulnerability could allow an attacker to trick a logged-in user into performing unauthorized ac...

CVE-2022-3897

CVE-2022-3897 : The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 6.3.9 due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions (or above) can inject arbitrar...

CVE-2024-5283

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page, specifically within the Lead Editing functionality....