CVE-2015-20105

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-352

Affected software

Vendor	Product	Versions
Unknown	ClickBank Affiliate Ads	>= 1.20, <= 1.20

References

https://packetstormsecurity.com/files/131814/Exploit, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2015/May/45Exploit, Mailing List, Third Party Advisory
https://wpscan.com/vulnerability/2bc3af7e-5542-40c4-8141-7c49e8df68f0Exploit, Third Party Advisory
https://packetstormsecurity.com/files/131814/Exploit, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2015/May/45Exploit, Mailing List, Third Party Advisory
https://wpscan.com/vulnerability/2bc3af7e-5542-40c4-8141-7c49e8df68f0Exploit, Third Party Advisory

Timeline

Published: Dec 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-201064.8The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site CVE-2015-201077.6In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.CVE-2015-201089.8xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not use CVE-2015-201095.5end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to CVE-2015-20119.0The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated user CVE-2015-201107.5JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first ch CVE-2015-201119.8miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffe CVE-2015-201123.4RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.CVE-2015-201134.3Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent cross-site scripting vulnerabilities that allow at CVE-2015-201146.1Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and scr CVE-2015-201156.1Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the fi CVE-2015-201166.1Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through f