Lucene search
MikaWPEX-ID:4385370E-CF99-4249-B2C1-90CBFA8378A4HistoryAug 16, 2022 - 12:00 a.m.
Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scripting
2022-08-1600:00:00
Mika
327
affiliates manager
admin
stored cross-site scripting
payload
settings
plugin
exploit
minimum payout amount
email name
EPSS
0.001
Percentile
24.8%
The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Put the following payload in the "Currency Symbol" settings of the plugin and save: "><svg/onload=prompt(/XSS/)>
Other settings are affected (such as Minimum Payout Amount, Email Name etc)Related
patchstack
patchstack
wpvulndb
wpvulndb
Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scripting
2022-08-16 00:00:00
cvelist
cvelist
cve
cve
CVE-2022-2799
2022-09-16 09:15:11
nvd
nvd
CVE-2022-2799
2022-09-16 09:15:11
prion
prion
Cross site scripting
2022-09-16 09:15:00
openvas
openvas
WordPress Affiliates Manager Plugin < 2.9.14 Multiple Vulnerabilities
2023-02-17 00:00:00