CVE-2022-2798: Affiliates Manager < 2.9.14 - Affiliate CSV Injection

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-16 · updated 2026-06-17
Weakness: CWE-1236

Description

The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data

Affected products

Affiliates Manager: before 2.9.14 — fixed in 2.9.14

How to fix

Upgrade to a fixed version: Affiliates Manager 2.9.14. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd
https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd

Get alerted when CVE-2022-2798 or the next vulnerability affects your stack