6.4
Moyenne
CVE-2026-6672 The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
Description
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'slicewp_affiliate_url' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Affiliate Program Suite — SliceWP Affiliates 1.2 | premières → 1.2.7 | Pas de correctif indiqué |
Autres CVE de Affiliate Program Suite — SliceWP Affiliates
Les 4 CVE de Affiliate Program Suite — SliceWP Affiliates →
CVE-2026-120043
Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter
7.5
Élevée
CVE-2024-12454
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…
6.1
Moyenne
CVE-2024-8714
The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site…
6.1
Moyenne