Affiliate Program Suite — SliceWP Affiliates

SliceWP through 1.2.10 allows an unauthenticated attacker to inject script into affected output. The script executes when a victim interacts with that output and can act within the victim's browser session.

SliceWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.2.6.

Affiliate Program Suite — SliceWP Affiliates is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

SliceWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WordPress Affiliates Plugin — SliceWP Affiliates is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SliceWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.