WordPress Plugin AAWP 3.16 contains a reflected cross‑site scripting flaw that can be triggered by manipulating the tab parameter on its settings page. Attackers construct URLs that inject malicious JavaScript which will execute in the browsers of authenticated users who visit the admin page. This allows an attacker to run arbitrary scripts with the privileges of the logged‑in user, potentially hijacking accounts, stealing credentials, or distributing malware.

WordPress Plugin AAWP version 3.16, developed by Getaawp.

The CVSS score of 5.1 indicates medium severity. Exploitation requires an authenticated user to access the malicious link, and no active exploits are listed in CISA KEV. The likely attack vector involves a malicious URL sent to a logged‑in administrator, who then unknowingly triggers the XSS payload.