CVE-2024-34413

The SliceWP Affiliates plugin through version 1.1.10 contains a stored cross-site scripting vulnerability in its administrator settings caused by inadequate sanitization of user input and failure to properly escape output. Attackers with administrator access or higher can inject malicious scripts that execute when other users view affected pages, though this vulnerability only impacts multisite WordPress installations or configurations where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).