WP Affiliate Platform

WP Affiliate Platform has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2024; all 12 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (58%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 12 issues recorded for WP Affiliate Platform has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (7) reported by Bob Matyas.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Affiliate Platform vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-3898

WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

12 records


2024-07-08 00:00	WP Affiliate Platform <= 6.5.1 - Cross-Site Request Forgery to Afilliate Deletion WP Affiliate Platform <= 6.5.1	`CVE-2024-5285`	5.4 Medium	Bob Matyas	Yes
2024-06-22 00:00	WP Affiliate Platform <= 6.5.0 - Cross-Site Request Forgery to Cross-Site Scripting WP Affiliate Platform <= 6.5.0	`CVE-2024-5280`	6.1 Medium	Felipe Caon	Yes
2024-06-22 00:00	WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Lead Editing WP Affiliate Platform < 6.5.1	`CVE-2024-5283`	6.1 Medium	Bob Matyas	Yes
2024-06-22 00:00	WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Registration Form WP Affiliate Platform < 6.5.1	`CVE-2024-5282`	6.1 Medium	Bob Matyas	Yes
2024-06-22 00:00	WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Banner Editing WP Affiliate Platform < 6.5.1	`CVE-2024-5286`	6.1 Medium	Bob Matyas	Yes
2024-06-22 00:00	WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Profile Update WP Affiliate Platform < 6.5.1	`CVE-2024-5287`	5.4 Medium	Bob Matyas	Yes
2024-06-22 00:00	WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Affiliate Editing WP Affiliate Platform < 6.5.1	`CVE-2024-5281`	6.1 Medium	Bob Matyas	Yes
2024-06-22 00:00	WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting WP Affiliate Platform < 6.5.1	`CVE-2024-5284`	6.1 Medium	Bob Matyas	Yes
2022-11-08 00:00	WP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting WP Affiliate Platform <= 6.3.9	`CVE-2022-3896`	6.1 Medium	Marco Wotschka	Yes
2022-11-08 00:00	WP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting WP Affiliate Platform <= 6.3.9	`CVE-2022-3897`	5.5 Medium	Marco Wotschka	Yes

Showing 1–10 of 12 reports