CVE Feed

    Dashboard / CVE / CVE-2022-3898

    CVE-2022-3898

    The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

    Published:Nov 29, 2022
    Last Modified:Apr 8, 2026
    EPS:Nov 29, 2022
    EPSS Score:0.00139
    CVSS Score:8.8

    Affected Products

    Vendor
    Tipsandtricks-hq
    Product
    Wp Affiliate Platform

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-5285 (CVSS 5.5) — The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affili…
    CVE-2024-5287 (CVSS 7.1) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its se…
    CVE-2024-5286 (CVSS 4.8) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before output…
    CVE-2024-5284 (CVSS 6.8) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missin…
    CVE-2024-5283 (CVSS 6.1) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before output…
    CVE-2024-5282 (CVSS 6.1) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before output…
    CVE-2024-5281 (CVSS 6.1) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before output…
    CVE-2024-5280 (CVSS 4.7) — The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missin…
    CVE-2022-3897 (CVSS 5.5) — The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parame…
    CVE-2022-3896 (CVSS 6.1) — The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["R…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High