Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: wp.insider, wpaffiliatemgr Component: Affiliates Manager Clear all filters
TI-2024-00793 CVE-2024-0859 · GHSA-fwm6-ghvh-8mr4

Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery

Priority LOW 20

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00312 Published 2024-02-05 No fix listed CWE-352
TI-2022-02594 CVE-2022-2799 · GHSA-gg3w-9qrw-p79x

Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capabi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00677 Published 2022-09-16 Fixed in 2.9.14 CWE-79
TI-2022-02593 CVE-2022-2798 · GHSA-j77h-m5qv-6jf7

Affiliates Manager < 2.9.14 - Affiliate CSV Injection

Priority LOW 37

The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the da…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01226 Published 2022-09-16 Fixed in 2.9.14 CWE-1236
TI-2021-07356 CVE-2021-25078 · GHSA-fm8r-hhjh-xqg8

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 32

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Script…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02288 Published 2022-01-24 Fixed in 2.9.0 CWE-79
TI-2021-07126 CVE-2021-24844 · GHSA-jcf4-w72w-52p8

Affiliate Manager < 2.8.7 - Admin+ SQL injection

Priority LOW 35

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01533 Published 2021-11-08 Fixed in 2.8.7 CWE-89