Now officially on WordPress.org

CVE Database / CVE-2024-12454

CVE · Medium

CVE-2024-12454 — Affiliate Program Suite — SliceWP Affiliates [slicewp] < 1.1.24

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-12454 Affiliate Program Suite — SliceWP Affiliates [slicewp] < 1.1.24 Cross-Site Request Forgery (CSRF) Medium 6.1 < 1.1.24 1.1.24 2024-12-17 —

CVE-2024-12454

The SliceWP Affiliates plugin for WordPress versions up to 1.1.23 contains a cross-site request forgery vulnerability resulting from inadequate nonce verification in a specific function. An attacker without authentication could execute malicious scripts by crafting a forged request, provided they successfully deceive a site administrator into clicking a malicious link or performing a similar action. This flaw was resolved in version 1.1.24.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings