Thirstyaffiliates
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:thirstyaffiliates:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Thirstyaffiliates (cd2a4d8f-16a5-5207-9840-2faee54eab16) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-97314 |
vulnerable | 2026-11-03 10:15:27.482491 |
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
Published: 2026-10-17T06:00:15.251Z
Updated: 2026-10-18T11:12:31.635Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0634 |
vulnerable | 2026-06-08 05:39:10.428234 |
ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF
The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
Published: 2022-04-25T15:51:00.000Z
Updated: 2024-08-02T23:32:46.452Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24127 |
vulnerable | 2026-06-08 05:30:03.822410 |
ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS
Unvalidated input and lack of output encoding in the ThirstyAffiliates Affiliate Link Manager WordPress plugin, versions before 3.9.3, was vulnerable to authenticated Stored Cross-Site Scripting (XSS), which could lead to privilege escalation.
Published: 2021-03-18T14:57:48.000Z
Updated: 2024-08-03T19:21:18.298Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.