WordPress Awin Data Feed <=1.6 - Cross-Site Scripting
WordPress Awin Data Feed plugin 1.6 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action, available to both unauthenticated and authenticated users.
awin_data_feedPoC 已收录
CVSS6.1EPSS 3.0%