Vulnerabilities

TI-2024-09130 CVE-2024-9838 · GHSA-28cc-3w24-mfvx

Auto Affiliate Links < 6.4.7 - Admin+ SQL Injection

MEDIUM 60

The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0034 Published 2025-05-15 Fixed in 6.4.7 CWE-89

TI-2024-01715 CVE-2024-1843 · GHSA-724m-f653-3f8m

Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink

LOW 21

The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00533 Published 2024-03-13 No fix listed CWE-862

TI-2023-25792 CVE-2023-47652 · GHSA-j4gp-vqp3-jp8r

WordPress Auto Affiliate Links Plugin <= 6.4.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 31

Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links allows Stored XSS.This issue affects Auto Affiliate Links: from n/a through 6.4.2.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00208 Published 2023-11-13 No fix listed CWE-352

TI-2023-08864 CVE-2023-22689 · GHSA-2g2v-w577-39wq

WordPress Auto Affiliate Links Plugin <= 6.3 is vulnerable to Broken Access Control

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00257 Published 2023-05-20 No fix listed CWE-352

TI-2023-11218 CVE-2023-25973 · GHSA-f7h6-8w5j-4h4c

WordPress Auto Affiliate Links Plugin <= 6.3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)