CVE-2015-20105
ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site Scripting
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
02 Dec 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
Affected products
Unknown · ClickBank Affiliate AdsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →