CVE-2022-0818: Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-28 · updated 2026-06-17
Weakness: CWE-79

Description

The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.

Affected products

WooCommerce Affiliate Plugin – Coupon Affiliates: before 4.16.4.5 — fixed in 4.16.4.5

How to fix

Upgrade to a fixed version: WooCommerce Affiliate Plugin – Coupon Affiliates 4.16.4.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/c43fabb4-b388-462c-adc4-c6b25af7043b
https://wpscan.com/vulnerability/c43fabb4-b388-462c-adc4-c6b25af7043b

Get alerted when CVE-2022-0818 or the next vulnerability affects your stack