Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Caseproof, LLC Component: Thirstyaffiliates Affiliate Link Manager Clear all filters
TI-2022-00551 CVE-2022-0634 · GHSA-3m3x-cxhv-x999

ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF

Priority LOW 20

The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external UR…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00347 Published 2022-04-25 Fixed in 3.10.5 CWE-352
TI-2022-00323 CVE-2022-0398 · GHSA-mvmq-p5xj-8vj6

ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation

Priority LOW 24

The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to creat…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00313 Published 2022-04-25 Fixed in 3.10.5 CWE-352
TI-2021-06419 CVE-2021-24127 · GHSA-x959-3cr2-q2g9

ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS

Priority LOW 25

Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead t…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00653 Published 2021-03-18 Fixed in 3.9.3 CWE-79