Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 2.3%
exploitation probability
2.3%top 18% of all CVEs
observed exploitation
nono source reports it
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Affected products
Unknown · Affiliates Manager