CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The Affiliate Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘numColumns’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in Affiliate Reviews plugin for WordPress (versions up to 1.0.6) allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'numColumns' parameter, which executes in the browsers of any user viewing the affected page. The vulnerability stems from insufficient input sanitization and output escaping in the block-reviews-grid-style.php template. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The Affiliate Reviews WordPress plugin fails to properly sanitize and escape user input in the 'numColumns' parameter before rendering it in the block-reviews-grid-style.php template. This is a Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where malicious JavaScript is persisted in the WordPress database and executed whenever the affected page is accessed by any user, regardless of privilege level. The vulnerability requires an authenticated user with Contributor-level access or above to inject the payload, but the execution context (Stored XSS) means the payload affects all site visitors. The WordPress plugin ecosystem is a common attack surface due to the prevalence of plugins with variable security standards and widespread WordPress installations.
Affected ProductsAI
Affiliate Reviews plugin for WordPress versions 1.0.6 and earlier are affected. The plugin is distributed through the official WordPress.org plugin repository (https://wordpress.org/plugins/affiliate-reviews/). The vulnerable code is present in the block-reviews-grid-style.php template file as referenced in the WordPress plugin repository browser and changeset 3345717. No CPE identifier is available in the provided data, but the affected software can be identified by plugin slug 'affiliate-reviews' with version number up to and including 1.0.6.
RemediationAI
Update the Affiliate Reviews plugin to version 1.0.7 or later, which addresses the input sanitization and output escaping issues in the 'numColumns' parameter. This patch was released via WordPress plugin repository changeset 3345717 (https://plugins.trac.wordpress.org/changeset/3345717/). Site administrators should verify plugin updates are enabled and apply the patch immediately. Until patching is possible, temporarily disable or deactivate the Affiliate Reviews plugin to prevent exploitation. Review and audit any pages or posts that used the Affiliate Reviews block with the 'numColumns' parameter to identify and remove any injected malicious scripts. Restrict Contributor-level and Editor-level account creation to trusted users only, and implement regular user access reviews. Additional context and vulnerability details are available from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd11b05-feb0-4e32-b11d-9c8f10ddf30a?source=cve).
Share
External POC / Exploit Code
Leaving vuln.today