CVE-2022-2798

Affiliates Manager < 2.9.14 - Affiliate CSV Injection

The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data

Affected

Affiliates Manager

CVSS v3.1 NVD

8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

1.23% chance of exploitation in the next 30 days, 68th percentile

Published

2022-09-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd

References

• CVE Record
• NVD entry