CVE-2024-5283: 
WordPress vulnerability analysis and mitigation

The wp-affiliate-platform WordPress plugin before version 6.5.1 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on June 22, 2024, and was assigned CVE-2024-5283. The issue affects high privilege users such as administrators of WordPress installations running vulnerable versions of the plugin (WPScan).

The vulnerability stems from improper sanitization and escaping of parameters before outputting them back in the page during lead editing functionality. This results in a Reflected Cross-Site Scripting vulnerability that could be exploited against high privilege users such as administrators. The vulnerability has been assigned a CVSS score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (WPScan).

The vulnerability allows attackers to potentially execute arbitrary JavaScript code in the context of an administrator's browser session, which could lead to unauthorized actions being performed with administrative privileges (WPScan).

The vulnerability requires user interaction and can be exploited against high privilege users such as administrators. The vulnerability has been publicly disclosed with proof of concept details available (WPScan).

The vulnerability has been fixed in wp-affiliate-platform version 6.5.1. Users are advised to update to this version or later to mitigate the risk (WPScan).