Executive Summary

The Auto Affiliate Links plugin for WordPress versions up to and including 6.8.8 has a Stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize the 'url' POST parameter in the aal_url_stats_save_action() function. Additionally, it fails to escape output in the aal_display_clicks() function, where the stored value is directly inserted into an anchor element's href attribute and inner text without using proper escaping functions like esc_url(), esc_attr(), or esc_html().

As a result, unauthenticated attackers can inject malicious web scripts into the admin statistics page. These scripts execute in the browser of an administrator when they visit the page. The attack leverages a publicly exposed nonce and an unauthenticated AJAX endpoint registered via the wp_ajax_nopriv_ hook.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to execute arbitrary scripts in the context of an administrator's browser. This can lead to several impacts including theft of administrator credentials, unauthorized actions performed with administrator privileges, and potential compromise of the WordPress site.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into the admin statistics page, which execute in an administrator's browser. This can lead to unauthorized access or manipulation of sensitive data within the WordPress environment.

Such unauthorized access and potential data manipulation could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

However, the provided information does not explicitly detail the direct compliance implications or specific regulatory impacts of this vulnerability.

Useful 0 Not Useful 0