Medium severity · published Jan 24, 2022
CVE-2021-25078
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing…
6.1
CVSS
2.3%
EPSS
No
On KEV
Description
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Affiliates Manager · Wpaffiliatemanager
before 2.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25078
Patch
https://plugins.trac.wordpress.org/changeset/2648196
Exploit
https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e
More from Affiliates Manager
8.8
CVE-2023-52130
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31
8.8
CVE-2023-28986
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions
8.8
CVE-2019-15868
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF
8.0
CVE-2022-2798
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection…
7.2
CVE-2021-24844
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL…