WordPress plugin
Affiliate Program Suite — SliceWP Affiliates security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium6
- Low0
All Affiliate Program Suite — SliceWP Affiliates vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated SQL Injection via 'email' Parameter ≤1.2.14Update to 1.2.15 | CVE-2026-120043 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.2.13Update to 1.2.14 | CVE-2026-115612 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.2.10Update to 1.2.11 | CVE-2026-82224 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.2.6Update to 1.2.7 | CVE-2026-42653 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode ≤1.2.7Update to 1.2.8 | CVE-2026-6672 | |
| Medium6.1 | Cross-Site Request Forgery to Reflected Cross-Site Scripting ≤1.1.23Update to 1.1.24 | CVE-2024-12454 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.1.18Update to 1.1.19 | CVE-2024-47388 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.1.20Update to 1.1.21 | CVE-2024-8714 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤1.1.10Update to 1.1.11 | CVE-2024-34413 | |
| Medium6.1 | Cross-Site Scripting ≤1.0.45Update to 1.0.46 | — |
- High7.5Unauthenticated SQL Injection via 'email' Parameter
≤1.2.14Update to 1.2.15
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.2.13Update to 1.2.14
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.2.10Update to 1.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.2.6Update to 1.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode
≤1.2.7Update to 1.2.8
- Medium6.1Cross-Site Request Forgery to Reflected Cross-Site Scripting
≤1.1.23Update to 1.1.24
- Medium6.1Reflected Cross-Site Scripting
≤1.1.18Update to 1.1.19
- Medium6.1Reflected Cross-Site Scripting
≤1.1.20Update to 1.1.21
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.1.10Update to 1.1.11
- Medium6.1Cross-Site Scripting
≤1.0.45Update to 1.0.46
Affiliate Program Suite — SliceWP Affiliates: common questions
Does Affiliate Program Suite — SliceWP Affiliates have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in Affiliate Program Suite — SliceWP Affiliates: 4 high, 6 medium. None are known to affect version null.
How do I check which version of Affiliate Program Suite — SliceWP Affiliates I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Affiliate Program Suite — SliceWP Affiliates vulnerability?
CVE-2026-120043, published Nov 6, 2026: Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter. Severity: High (CVSS 7.5).
Is any Affiliate Program Suite — SliceWP Affiliates vulnerability listed in CISA KEV?
No. None of the known Affiliate Program Suite — SliceWP Affiliates vulnerabilities is currently listed in the CISA KEV catalog.