CVE-2024-5284: WP Affiliate Platform < 6.5.1 - Stored XSS via CSRF
Published Jul 13, 2024
·Updated
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Affected Software
2 affected components
Tipsandtricks-hq Wp Affiliate Platform Wordpress<6.5.1
WordPress wp-affiliate-platform<6.5.1
Event History
Jul 13, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-5284?
CVE-2024-5284 has a high severity due to the potential for Stored XSS attacks and the lack of CSRF protection.
2
How do I fix CVE-2024-5284?
To fix CVE-2024-5284, update the wp-affiliate-platform plugin to version 6.5.1 or later.
3
What are the key vulnerabilities associated with CVE-2024-5284?
CVE-2024-5284 includes the absence of CSRF checks and lack of proper sanitization and escaping.
4
Who is affected by CVE-2024-5284?
Any WordPress site using the wp-affiliate-platform plugin version prior to 6.5.1 is affected by CVE-2024-5284.
5
What types of attacks can exploit CVE-2024-5284?
CVE-2024-5284 can be exploited to perform Stored XSS attacks via CSRF.