6.1
Medium
CVE-2024-12454 The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…
Description
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Affiliate Program Suite — SliceWP Affiliates 1.1 | earliest → 1.1.23 | No fix stated |
Other CVEs of Affiliate Program Suite — SliceWP Affiliates
The 4 CVEs of Affiliate Program Suite — SliceWP Affiliates →
CVE-2026-120043
Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter
7.5
High
CVE-2026-6672
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
6.4
Medium
CVE-2024-8714
The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site…
6.1
Medium