Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
CVE-2021-25078

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Affiliates Manager
Vendor: CVE Published:; 24 January 2022

What is CVE-2021-25078?

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.

Affected Version(s)

Affiliates Manager 2.9.0

References

https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-...

x_refsource_MISC

https://plugins.trac.wordpress.org/changeset/2648196

x_refsource_CONFIRM

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 24, 2022
Vulnerability Reserved
Jan 14, 2021

Credit

Krzysztof Zając

CVE-2021-25078 Data

JSON