WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-46086

7.1HIGH

Key Information:

Vendor

WordPress
Status
Affiliate-toolkit – WordPress Affiliate Plugin
Vendor
CVE Published:
30 November 2023

What is CVE-2023-46086?

An improper neutralization of input during web page generation allows an attacker to exploit the reflected XSS vulnerability in the Affiliate-Toolkit WordPress Affiliate Plugin. This flaw can enable malicious users to execute arbitrary scripts in the context of a user’s browser session, leading to unauthorized actions or data exposure. The affected versions range from n/a through 3.4.3, necessitating immediate attention from site administrators to mitigate the associated risks and safeguard user data.

Affected Version(s)

affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3

References

https://patchstack.com/database/vulnerability/affiliate-t...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LEE SE HYOUNG (Patchstack Alliance)
.