Read the docs

wp.insider, wpaffiliatemgr

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

wp.insider, wpaffiliatemgr records in CISA KEV

No wp.insider, wpaffiliatemgr vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Affiliates Manager 9 records LOW

Records

9 records in Affiliates Manager · all components

TI-2022-02593 CVE-2022-2798 · GHSA-j77h-m5qv-6jf7

Affiliates Manager < 2.9.14 - Affiliate CSV Injection

Priority LOW 37

The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the da…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01226 Published 2022-09-16 Fixed in 2.9.14 CWE-1236
TI-2021-07126 CVE-2021-24844 · GHSA-jcf4-w72w-52p8

Affiliate Manager < 2.8.7 - Admin+ SQL injection

Priority LOW 35

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01533 Published 2021-11-08 Fixed in 2.8.7 CWE-89
TI-2021-07356 CVE-2021-25078 · GHSA-fm8r-hhjh-xqg8

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 32

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Script…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02288 Published 2022-01-24 Fixed in 2.9.0 CWE-79
TI-2022-02594 CVE-2022-2799 · GHSA-gg3w-9qrw-p79x

Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capabi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00677 Published 2022-09-16 Fixed in 2.9.14 CWE-79
TI-2024-00793 CVE-2024-0859 · GHSA-fwm6-ghvh-8mr4

Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery

Priority LOW 20

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00312 Published 2024-02-05 No fix listed CWE-352
Open these records in search →