CVE-2024-5284

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This flaw arises from a lack of CSRF checks in certain areas, combined with missing sanitization and escaping. An attacker could leverage these weaknesses to force...

CVE-2024-5281

The wp-affiliate-platform WordPress plugin versions prior to 6.5.1 are vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page, specifically within the Affiliate Editing...

CVE-2022-3898

CVE-2022-3898 affects the WordPress WP Affiliate Platform plugin (versions up to 6.3.9). The root cause is missing or incorrect nonce validation on multiple functions, including the affiliates_menu method, enabling CSRF. This can allow unauthenticated attackers to delete affiliate records by tric...

CVE-2024-5282

The wp-affiliate-platform WordPress plugin (versions prior to 6.5.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a specific parameter before it is outputted back onto the page, specifically via the registration form . This vulnerab...

CVE-2024-5280

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) . The root cause is a lack of CSRF checks in certain areas combined with missing input sanitization and output escaping. This flaw could allow...

CVE-2022-3896

The CVE-2022-3896 entry concerns the WP Affiliate Platform plugin for WordPress. A Reflected Cross-Site Scripting vulnerability exists via the $_SERVER["REQUEST_URI"] parameter in versions up to and including 6.3.9, caused by insufficient input sanitization and output escaping. This allows unauth...

CVE-2024-5285

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when deleting affiliates. An attacker could potentially trick a logged-in user into performing unauthorized actions, such a...

CVE-2024-5287

The wp-affiliate-platform WordPress plugin versions prior to 6.5.1 are vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of proper CSRF checks when updating settings. An attacker could exploit this to trick a logged-in user into making unauthorized changes to the plugin's set...

CVE-2024-5286

The wp-affiliate-platform WordPress plugin versions prior to 6.5.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a parameter before it is output back to the page. This flaw could be exploited against high-privilege users, such as admi...

CVE-2024-5283

The wp-affiliate-platform WordPress plugin, in versions prior to 6.5.1 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page, specifically identified in the context of Lead Edit...

CVE-2022-3897

CVE-2022-3897 : The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 6.3.9 due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions (or above) can inject arbitrar...