Vulnerabilities

TI-2026-86202 CVE-2026-120043 · GHSA-cxh3-2w2w-7cgr

Affiliate Program Suite SliceWP SQL Injection via email Parameter

LOW 39

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00403 Published 2026-11-07 No fix listed CWE-89

TI-2026-81971 CVE-2026-115612 · GHSA-9xx4-r7q6-h4gh

Stored cross-site scripting in WordPress SliceWP plugin

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00201 Published 2026-10-28 No fix listed CWE-79

TI-2026-56691 CVE-2026-82224 · GHSA-h9c5-cwm2-8wj5

WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-31 No fix listed CWE-79

TI-2026-30912 CVE-2026-42653 · GHSA-36wv-jqc8-m47v

WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-06-11 No fix listed CWE-79

TI-2026-05854 CVE-2026-6672 · GHSA-2h5w-9g5w-vwph

Cross-site scripting in iova.mihai Affiliate Program Suite — SliceWP Affiliates

LOW 27

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00152 Published 2026-05-06 No fix listed CWE-79

TI-2025-16588 CVE-2025-22706 · GHSA-vfrm-8x77-ccpw

WordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00266 Published 2025-01-21 No fix listed CWE-79

TI-2024-11556 CVE-2024-12454 · GHSA-v577-jpx7-f7h9

Affiliate Program Suite — SliceWP Affiliates <= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

LOW 27

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00207 Published 2024-12-18 No fix listed CWE-352

TI-2024-31706 CVE-2024-47388 · GHSA-35jj-h5xp-mhvc

WordPress SliceWP Affiliates plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Reflected XSS.This issue affects SliceWP: from n/a through <= 1.1.18.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0032 Published 2024-10-05 No fix listed CWE-79

Vulnerabilities

Filters