Skip to content
Sign in
Not rated

CVE-2021-24127 Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions…

Description

Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead to privilege escalation.

Affected products and versions

Product Affected versions Fixed in
ThirstyAffiliates 3.9 earliest → < 3.9.3 3.9.3

Other CVEs of ThirstyAffiliates

The 3 CVEs of ThirstyAffiliates →
CVE-2026-97314 The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its… 6.5 Medium CVE-2022-0634 The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image… Not rated
Track this CVE