CVE-2024-5284

The CVE-2024-5284 entry concerns the WordPress plugin wp-affiliate-platform prior to 6.5.1, which is reported to lack CSRF checks in some areas and to have insufficient sanitisation/escaping. This could enable a logged-in administrator to trigger a Stored XSS payload via CSRF. Red Hat confirms th...

CVE-2024-5281

The CVE-2024-5281 entry is valid and supported by connected sources describing a Reflected XSS in the WP Affiliate Platform plugin (versions before 6.5.1) caused by not sanitising/escaping a parameter before echoing it to the page. Impact is noted as potentially exploitable against admin/high-pri...

CVE-2022-3898

CVE-2022-3898 affects the WordPress WP Affiliate Platform plugin (versions up to 6.3.9). The root cause is missing or incorrect nonce validation on multiple functions, including the affiliates_menu method, enabling CSRF. This can allow unauthenticated attackers to delete affiliate records by tric...

CVE-2024-5282

CVE-2024-5282 — wp-affiliate-platform prior to 6.5.1 allows reflected XSS by not sanitizing/escaping a parameter before echoing it. Impact targets high-privilege users (admin). Remediation: upgrade to version 6.5.1 or later (patched). References across connected feeds corroborate the reflected XS...

CVE-2024-5280

CVE-2024-5280 affects the WordPress plugin wp-affiliate-platform, versions prior to 6.5.1. The issue is due to missing CSRF checks across several areas and insufficient sanitisation/escaping, which could allow an attacker to cause a non-logged-in user to execute a reflected XSS payload via a CSRF...

CVE-2024-5287

CVE-2024-5287 affects the WordPress plugin wp-affiliate-platform prior to version 6.5.1. The vulnerability is a lack of CSRF protection when updating plugin settings, potentially allowing an authenticated attacker to cause a logged-in user to modify settings via a CSRF attack. The issue is docume...

CVE-2022-3896

The CVE-2022-3896 entry concerns the WP Affiliate Platform plugin for WordPress. A Reflected Cross-Site Scripting vulnerability exists via the $_SERVER["REQUEST_URI"] parameter in versions up to and including 6.3.9, caused by insufficient input sanitization and output escaping. This allows unauth...

CVE-2024-5286

CVE-2024-5286 concerns the WordPress plugin WP Affiliate Platform . The vulnerability arises in versions prior to 6.5.1 where a parameter is not properly sanitized/escaped before being output on a page, resulting in a reflected Cross-Site Scripting (XSS) that could affect high-privilege accounts ...

CVE-2024-5283

The CVE-2024-5283 entry concerns the WP Affiliate Platform WordPress plugin (versions before 6.5.1). Affected functionality does not sanitise/escape a parameter before echoing it on the page, enabling a Reflected XSS. The vulnerability could be exploited against admin or other high-privilege user...

CVE-2024-5285

CVE-2024-5285 affects the WordPress plugin WP Affiliate Platform (prior to v6.5.2). The Red Hat and CVE ecosystem entries confirm a CSRF protection omission when deleting affiliates, enabling a logged-in user to be coerced into deleting affiliates via CSRF. The issue is mitigated by upgrading to ...

CVE-2022-3897

CVE-2022-3897 : The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 6.3.9 due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions (or above) can inject arbitrar...