CVE-2022-0818

The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.87% chance of exploitation in the next 30 days, 56th percentile

Published

2022-03-28

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c43fabb4-b388-462c-adc4-c6b25af7043b

References

• CVE Record
• NVD entry

Related

• CVE-2022-0817
• CVE-2022-0819
• CVE-2022-0814
• CVE-2022-0821
• CVE-2022-0811
• CVE-2022-0822