WordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

Amid the security review of AffiliateWP plugin for WordPress CMS, Security Vulnerabilities was found utilizing DefenseCode ThunderScan by Neven Biruski in application source code security testing phase.

Vulnerability Description

XSS is a very commonly exploited vulnerability type which is very widely spread and easily detectable.

An attacker can inject untrusted snippets of JavaScript into your application without validation. This JavaScript is then executed by the victim who is visiting the target site.
Read More about XSS.

In the event that the administrator of the site makes a request to such a URL, the attacker’s code will be executed, with unlimited access to the WordPress site being referred to. The attacker can attract the administrator to visit the URL in different ways, including sending the URL by email, posting it as a piece of the comment on the vulnerable site or another way.

For More information Refer DefenseCode Advisories.

Application Overview

As per the plugin creators, AffiliateWP is a simple to-utilize, solid WordPress module that gives you the affiliate marketing tools that used to develop your business and profit. In 2016 it outperformed $500,000 in yearly income.

Solution

The bug has been reported to Vendor by Defense code and they released a fix on 2017/05/17. So the solution is simple, you need to update to the latest available version of AffiliateWP plugin.

WordPress AffiliateWP Plugin Vulnerable for Cross-Site Scripting

Vulnerability Description

Application Overview

Solution

Read More

How To Access Dark Web Anonymously and know its Secretive and Mysterious Activities

How to Build and Run a Security Operations Center (SOC Guide) – 2023

Russian Hackers Bypass EDR to Deliver a Weaponized TeamViewer Component

Web Server Penetration Testing Checklist – 2026

ATM Penetration Testing – Advanced Testing Methods to Find The Vulnerabilities

Topics

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs

New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads

Related Articles

Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code

TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks

SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence

Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites

Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code

Recent News