6.8
Medium
CVE-2024-5284 The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing…
Description
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wp-affiliate-platform 6.5 | earliest → < 6.5.1 | 6.5.1 |
| wp_affiliate_platform 6.5 | earliest → < 6.5.1 | 6.5.1 |
Other CVEs of wp-affiliate-platform
The 8 CVEs of wp-affiliate-platform →
CVE-2024-5285
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates,…
5.5
Medium
CVE-2024-5286
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it…
4.8
Medium
CVE-2024-5287
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings,…
7.1
High
CVE-2024-5282
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it…
6.1
Medium