Threats tagged 'ghsa-v3rv-7vgj-hq3v'

The Auto Affiliate Links WordPress plugin versions up to and including 6.8.8 contain a stored cross-site scripting (XSS) vulnerability. This occurs due to insufficient sanitization of the 'url' POST parameter and lack of output escaping when displaying stored data. An unauthenticated attacker can exploit this via a publicly exposed AJAX endpoint to inject malicious scripts that execute in an administrator's browser when viewing the admin statistics page.