CVE-2024-5280

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	wp-affiliate-platform	< 6.5.1
wp_affiliate_platform_project	wp_affiliate_platform	< 6.5.1

References

https://wpscan.com/vulnerability/bbc214ba-4e97-4b3a-a21b-2931a9e36973/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/bbc214ba-4e97-4b3a-a21b-2931a9e36973/Exploit, Third Party Advisory

Timeline

Published: Jul 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-528002.3veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transfo CVE-2024-528015.3sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The Op CVE-2024-528027.5RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in CVE-2024-528039.8LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the CVE-2024-528047.5Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior CVE-2024-528057.5Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transient CVE-2024-528068.3SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAML CVE-2024-528078.6The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed CVE-2024-528095.3vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI CVE-2024-52816.1The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, lead CVE-2024-528106.9@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollu CVE-2024-528118.2The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to th