CVE-2022-0818
Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
- State
- Published
- Severity
- Not scored
- Published
- Mar 28, 2022
- Updated
- Aug 2, 2024
- Reserved
- Mar 1, 2022
Description
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
Scores
The record has no CVSS score.
Weaknesses
- CWE-79 Cross-site Scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
WooCommerce Affiliate Plugin – Coupon AffiliatesUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.