title: Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
description: The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: WooCommerce Affiliate Plugin – Coupon Affiliates
vendor: Unknown
versions:
lessThan: 4.16.4.5, status: affected, version: 4.16.4.5, versionType: custom
}