Affiliatewp
Monthly
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.