CVE-2024-5284

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

CVE-2024-5281

The CVE-2024-5281 entry is valid and supported by connected sources describing a Reflected XSS in the WP Affiliate Platform plugin (versions before 6.5.1) caused by not sanitising/escaping a parameter before echoing it to the page. Impact is noted as potentially exploitable against admin/high-pri...

CVE-2022-3898

CVE-2022-3898 affects the WordPress WP Affiliate Platform plugin (versions up to 6.3.9). The root cause is missing or incorrect nonce validation on multiple functions, including the affiliates_menu method, enabling CSRF. This can allow unauthenticated attackers to delete affiliate records by tric...

CVE-2024-5282

CVE-2024-5282 — wp-affiliate-platform prior to 6.5.1 allows reflected XSS by not sanitizing/escaping a parameter before echoing it. Impact targets high-privilege users (admin). Remediation: upgrade to version 6.5.1 or later (patched). References across connected feeds corroborate the reflected XS...

CVE-2024-5280

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to a Cross-Site Scripting (XSS) attack. The root cause is a combination of missing CSRF checks , lack of proper sanitization , and missing escaping in specific areas of the plugin. This flaw could allow an unau...

CVE-2022-3896

The CVE-2022-3896 entry concerns the WP Affiliate Platform plugin for WordPress. A Reflected Cross-Site Scripting vulnerability exists via the $_SERVER["REQUEST_URI"] parameter in versions up to and including 6.3.9, caused by insufficient input sanitization and output escaping. This allows unauth...

CVE-2024-5286

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVE-2024-5287

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack

CVE-2024-5285

The wp-affiliate-platform WordPress plugin (versions prior to 6.5.2 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when deleting affiliates. This vulnerability could allow an attacker to trick a logged-in user into performing unauthorized ac...

CVE-2022-3897

CVE-2022-3897 : The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 6.3.9 due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions (or above) can inject arbitrar...

CVE-2024-5283

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin