Clickbank Affiliate Ads CVEs and Security Vulnerabilities

Vulnerabilities (Clickbank Affiliate Ads)

CVE-2015-20106

ClickBank Affiliate Ads <= 1.20 - Admin+ Stored Cross-Site Scripting

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cbads

Products

Clickbank Affiliate Ads

CVE-2015-20105

ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site Scripting

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed