Affiliate Super Assistent
Monthly
Stored XSS in the Affiliate Super Assistent WordPress plugin (≤ 1.10.2) enables unauthenticated attackers to inject persistent JavaScript payloads via the doCommentShortcode function in AsaCore.php, which executes in the browser of any visitor loading an affected page. The vulnerability carries a CVSS 7.2 (High) score reflecting network accessibility, no authentication requirement, and scope change to the victim browser context. No active exploitation or public PoC has been identified at time of analysis; an upstream fix commit (changeset 3672410) is available via the WordPress plugin repository.
The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored XSS in the Affiliate Super Assistent WordPress plugin (≤ 1.10.2) enables unauthenticated attackers to inject persistent JavaScript payloads via the doCommentShortcode function in AsaCore.php, which executes in the browser of any visitor loading an affected page. The vulnerability carries a CVSS 7.2 (High) score reflecting network accessibility, no authentication requirement, and scope change to the victim browser context. No active exploitation or public PoC has been identified at time of analysis; an upstream fix commit (changeset 3672410) is available via the WordPress plugin repository.
The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.