Sunday, April 13, 2025
Follow us On Linkedin
HomeWordpressWordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

WordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

Wordpress

Published on

By Gurubaran
WordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

Supply Chain Attack Prevention

SIEM as a Service

Follow Us on Google News

Amid the security review of AffiliateWP plugin for WordPress CMS, Security Vulnerabilities was found utilizing DefenseCode ThunderScan by Neven Biruski in application source code security testing phase.

Vulnerability Description

XSS is a very commonly exploited vulnerability type which is very widely spread and easily detectable.

An attacker can inject untrusted snippets of JavaScript into your application without validation. This JavaScript is then executed by the victim who is visiting the target site.
Read More about XSS.

- Advertisement - Google News
In the event that the administrator of the site makes a request to such a URL, the attacker’s code will be executed, with unlimited access to the WordPress site being referred to. The attacker can attract the administrator to visit the URL in different ways, including sending the URL by email, posting it as a piece of the comment on the vulnerable site or another way.

For More information Refer DefenseCode Advisories.

Application Overview

As per the plugin creators, AffiliateWP is a simple to-utilize, solid WordPress module that gives you the affiliate marketing tools that used to develop your business and profit. In 2016 it outperformed $500,000 in yearly income.

Solution

The bug has been reported to Vendor by Defense code and they released a fix on 2017/05/17. So the solution is simple, you need to update to the latest available version of AffiliateWP plugin.

Read More

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

cyber security

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate...
Android

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as...
Cyber Attack

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains,...
cyber security

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

Register Now

More like this

cyber security

Rogue Account‑Creation Flaw Leaves 100 K WordPress Sites Exposed

A severe vulnerability has been uncovered in the SureTriggers WordPress plugin, which could leave...
Cyber Attack

50,000+ WordPress Sites Vulnerable to Privilege Escalation Attacks

In a recent cybersecurity development, over 50,000 WordPress websites using the Uncanny Automator plugin...
CVE/vulnerability

20,000 WordPress Sites at Risk of File Upload & Deletion Exploits

A critical security alert has been issued to WordPress site administrators following the discovery...

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

Company

Trending

Categories

Copyright @ 2016 - 2025 GBHackers On Security - All Rights Reserved