Sumo Affiliates Pro
Monthly
Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). The provided vector scores 7.1 (High), while the independent assessment applies no availability impact (A:N); no public exploit identified at time of analysis and no CISA KEV confirmation is present.
A PHP object injection vulnerability exists in FantasticPlugins SUMO Affiliates Pro due to unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject malicious serialized objects, potentially achieving remote code execution or other arbitrary actions depending on available gadget chains in the WordPress environment. All versions before 11.4.0 are affected, and a patch has been made available by the vendor.
Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). The provided vector scores 7.1 (High), while the independent assessment applies no availability impact (A:N); no public exploit identified at time of analysis and no CISA KEV confirmation is present.
A PHP object injection vulnerability exists in FantasticPlugins SUMO Affiliates Pro due to unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject malicious serialized objects, potentially achieving remote code execution or other arbitrary actions depending on available gadget chains in the WordPress environment. All versions before 11.4.0 are affected, and a patch has been made available by the vendor.