Saturday, December 28, 2024
Follow us On Linkedin
HomeWordpressWordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

WordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

Wordpress

Published on

By Gurubaran
WordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

API Security Audit

SIEM as a Service

Amid the security review of AffiliateWP plugin for WordPress CMS, Security Vulnerabilities was found utilizing DefenseCode ThunderScan by Neven Biruski in application source code security testing phase.

Vulnerability Description

XSS is a very commonly exploited vulnerability type which is very widely spread and easily detectable.

An attacker can inject untrusted snippets of JavaScript into your application without validation. This JavaScript is then executed by the victim who is visiting the target site.
Read More about XSS.

- Advertisement - SIEM as a Service
In the event that the administrator of the site makes a request to such a URL, the attacker’s code will be executed, with unlimited access to the WordPress site being referred to. The attacker can attract the administrator to visit the URL in different ways, including sending the URL by email, posting it as a piece of the comment on the vulnerable site or another way.

For More information Refer DefenseCode Advisories.

Application Overview

As per the plugin creators, AffiliateWP is a simple to-utilize, solid WordPress module that gives you the affiliate marketing tools that used to develop your business and profit. In 2016 it outperformed $500,000 in yearly income.

Solution

The bug has been reported to Vendor by Defense code and they released a fix on 2017/05/17. So the solution is simple, you need to update to the latest available version of AffiliateWP plugin.

Read More

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

cyber security

Lumma Stealer Attacking Users To Steal Login Credentials From Browsers

Researchers observed Lumma Stealer activity across multiple online samples, including PowerShell scripts and a...
Cyber Attack

New ‘OtterCookie’ Malware Attacking Software Developers Via Fake Job Offers

Palo Alto Networks reported the Contagious Interview campaign in November 2023, a financially motivated...
cyber security

NjRat 2.3D Pro Edition Shared on GitHub: A Growing Cybersecurity Concern

The recent discovery of the NjRat 2.3D Professional Edition on GitHub has raised alarms...
cyber security

Palo Alto Networks Vulnerability Puts Firewalls at Risk of DoS Attacks

A critical vulnerability, CVE-2024-3393, has been identified in the DNS Security feature of Palo...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

Register Now

More like this

CVE/vulnerability

200,000 WordPress Sites Exposed to Cyber Attack, Following Plugin Vulnerability

A critical security vulnerability has been discovered in the popular WordPress plugin Anti-Spam by CleanTalk,...
CVE/vulnerability

4M+ WordPress Websites to Attacks, Following Plugin Vulnerability

A critical vulnerability has been discovered in the popular "Really Simple Security" WordPress plugin,...
Cyber Attack

ClickFix Malware Infect Website Visitors Via Hacked WordPress Websites

Researchers have identified a new variant of the ClickFix fake browser update malware distributed...

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

Company

Trending

Categories

Copyright @ 2016 - 2024 GBHackers On Security - All Rights Reserved