VULNERABILITY INTELLIGENCE

CVE-2021-25078

CVSS score6.1 MEDIUM
EPSS probability2.29%
CISA KEVNot currently listed
Published2022-01-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.

Weakness classification

  • contact@wpscan.com: CWE-79
  • nvd@nist.gov: CWE-79

Primary references