title: Awin Data Feed < 1.8 - Unauthenticated Stored Cross-Site Scripting
description: The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
product: Awin Data Feed
vendor: Unknown
versions:
lessThan: 1.8, status: affected, version: 1.8, versionType: custom
}