Vulnerability · Published Jan 24, 2022 · Assigned by WPScan
CVE-2021-25078Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in Affiliates Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)2.3%top 16.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Affiliates Manager | 2.9.0 – before 2.9.0 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2648196 x_refsource_CONFIRM