Smart App Banner

Smart App Banner has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 4.9, and the most serious one scores 5.4 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Smart App Banner has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Smart App Banner is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium
4.9/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Smart App Banner vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2023-33315

Smart App Banner <= 1.1.2 - Cross-Site Request Forgery via wsl_smart_app_banner_options

Read the full analysis

Vulnerability Records

2 records
Smart App Banner banner
Latestv1.1.6

Smart App Banner

stephend

Author

stephend

4.7(3)
94/100
Last Updated
2024-03-23 (3y ago)
Active Installs
600+
Downloads
25,524
Requires WP
4.6+
Requires PHP
0+
Tested up to
WP 6.4.10
Created
2012-06-24 (14y ago)

This is a WordPress plugin that allows you to use the Smart App Banners with your WordPress blog. According to Apple, Smart App Banners: vastly improve users’ browsing experience compared to other promotional methods. As banners are implemented in iOS 6, they will provide a consistent look and feel across the web that users will come to recognize. Users will trust that tapping the banner will take them to the App Store and not a third-party advertisement. They will appreciate that banners are presented unobtrusively at the top of a webpage, instead of as a full-screen ad interrupting the web content. And with a large and prominent close button, a banner is easy for users to dismiss. It’s really simple to use. In short, you download and activate the plugin. On pages and posts you should find a “Smart App Banner” settings box. If you want the Smart App Banner to appear on this page then enter the App ID of your application here. You can also enter affiliate data and an app argument here. If you want to display a banner on the home page there’s a setting screen (Settings -> Smart App Banner) where you can enter the App ID. You can find the App ID in iTunes Connect, using the iTunes Link Maker or if the iTunes URL for your app looks like this: https://itunes.apple.com/us/app/rootn-tootn-baby-feed-timer/id530589336?ls=1&#038;mt=8 Then your ID is “530589336”. The other two fields are optional. The affiliate data field varies depending on the affiliate. The most common is PHG, where the value looks like “at=AFFILIATE_TOKEN” or “at=AFFILIATE_TOKEN&ct=CAMPAIGN” (without the quotes). You can find the token when you sign into the PHG website. The campaign is just some text you use to identify a particular marketing campaign. So I might have “at=11lmMT&ct=wordpress” on the product pages of my website. Check the documentation to find your affiliate token and confirm the format. According to the documentation, the app argument value is: A URL that provides context to your native app. If you include this, and the user has your app installed, she can jump from your website to the corresponding position in your iOS app. This plugin does not restrict or validate what you put here. You can format it however you’d like, as long as it is a valid URL.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C