CVE-2021-25078— Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-25078
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress plugin是WordPress开源的一个应用插件。 WordPress plugin Affiliates Manager 存在安全漏洞，该漏洞源于在2.9.0之前的affiliate Manager WordPress插件没有验证，清除和逃避点击跟踪功能记录的请求的IP地址。攻击者可利用该漏洞执行跨站点脚本攻击管理员查看跟踪的请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Affiliates Manager | 2.9.0 ~ 2.9.0 | - |
II. Public POCs for CVE-2021-25078
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25078.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-25078
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2022-01-24 · 32 CVEs total
| CVE-2021-25008 | Code Snippets < 2.14.3 - Reflected Cross-Site Scripting | |
| CVE-2021-25083 | Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting | |
| CVE-2021-25080 | Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting | |
| CVE-2021-25079 | Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting | |
| CVE-2021-25076 | WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting | |
| CVE-2021-25074 | WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect | |
| CVE-2021-25073 | WP125 < 1.5.5 - Arbitrary Ad Deletion via CSRF | |
| CVE-2021-25062 | Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting | |
| CVE-2021-25049 | Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-25045 | Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id | |
| CVE-2021-25035 | Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site Scripting | |
| CVE-2021-25031 | Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site Scripting | |
| CVE-2021-25028 | Event Tickets < 5.2.2 - Open Redirect | |
| CVE-2021-25017 | Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting | |
| CVE-2021-25015 | myCred < 2.4 - Reflected Cross-Site Scripting | |
| CVE-2021-25013 | Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion | |
| CVE-2021-24423 | UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24989 | Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF | |
| CVE-2021-24985 | Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site Scripting | |
| CVE-2021-24976 | Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting |
Showing top 20 of 32 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Affiliates Manager
- CVE-2024-0859
Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery - CVE-2023-52148
WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable - CVE-2023-52130
WordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable - CVE-2023-28986
WordPress Affiliates Manager Plugin <= 2.9.20 is vulnerable - CVE-2022-2799
Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scrip
Same vendor: Unknown
- CVE-2026-6433
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection t - CVE-2026-4935
SureTriggers < 1.1.23 – Unauthenticated SQLi - CVE-2026-5335
Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosu - CVE-2026-5337
Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary - CVE-2026-5306
Check & Log Email < 2.0.13 - Unauthenticated Stored XSS
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2021-25078
No comments yet