Coupon Affiliates vulnerabilities

Coupon Affiliates versions up to 7.8.1 have a vulnerability that allows the exposure of subscriber sensitive data.

Versions of Coupon Affiliates <= 7.5.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

The Coupon Affiliates plugin up to version 7.2.0 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.

The Coupon Affiliates plugin up to version 6.8.0 contains a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.