CVE-2021-25078CWE-79

CVE-2021-25078: fallo en Affiliates Manager

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

Publicada el · Actualizada el

18Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 2.3%
probabilidad de explotación
2.3%top 17% de las CVE
explotación observada
noninguna fuente lo reporta
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Productos afectados
Unknown · Affiliates Manager
CVEs relacionadas — Affiliates Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24844—Affiliate Manager < 2.8.7 - Admin+ SQL injectionEPSS 1.5%CVE-2022-2798—Affiliates Manager < 2.9.14 - Affiliate CSV InjectionEPSS 1.2%CVE-2022-2799—Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%
Referencias
https://plugins.trac.wordpress.org/changeset/2648196https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e