CVE-2015-20106

CVE-2015-20106: ClickBank Affiliate Ads <= 1.20 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product ClickBank Affiliate Ads

Weakness CWE-79 · XSS

Published December 2, 2021

Last update August 6, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

Key dates

02Disclosure timeline

December 2, 2021 CVE published

August 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2015-20106 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-41305 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output CVE-2023-25982 WordPress Simple YouTube Responsive Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS) CVE-2023-5351 Cross-site Scripting (XSS) - Stored in salesagility/suitecrm CVE-2023-43715 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) CVE-2026-20085 Cisco Integrated Management Controller Cross-Site Scripting Vulnerability