CVE-2022-0398

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03996.1The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter be CVE-2022-04007.5An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.CVE-2022-04019.8Path Traversal in NPM w-zip prior to 1.0.12.CVE-2022-04026.1The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana param CVE-2022-04038.1The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by CVE-2022-04046.5The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notic CVE-2022-04054.3Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04064.3Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04077.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04087.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04097.8Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.CVE-2022-04108.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a