CVE-2022-3896 WP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting

What is CVE-2022-3896?

CVE-2022-3896 is a medium-severity cross-site scripting vulnerability in tipsandtrickshq WP Affiliate Platform, published on 29 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers.

Weakness: CWE-79

Which versions are affected by CVE-2022-3896?

It affects 1 product.

Products include Tipsandtricks-Hq Wp Affiliate Platform.

How do I fix CVE-2022-3896?

No fix has been published for CVE-2022-3896 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-3896 being exploited?

There is no known exploitation of CVE-2022-3896 in the wild and no public exploit code.

Other vulnerabilities in tipsandtrickshq WP Affiliate Platform

• CVE-2022-3898 WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery High 8.8
• CVE-2024-5287 WP Affiliate Platform < 6.5.1 - Profile Update via CSRF High 7.1
• CVE-2024-5284 WP Affiliate Platform < 6.5.1 - Stored XSS via CSRF Medium 6.8
• CVE-2024-5281 WP Affiliate Platform < 6.5.1 - Reflected XSS via Affiliate Editing Medium 6.1
• CVE-2024-5282 WP Affiliate Platform < 6.5.1 - Reflected XSS via Registration Form Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j6cw-2jfh-cxfg.