The vulnerability exists in the Simple Amazon Affiliate WordPress plugin for all releases 1.0.9 or earlier. The plugin takes the value of the HTTP "msg" parameter, outputs it directly into a page without any escaping or sanitization, and therefore a crafted value containing JavaScript can be reflected back to the victim’s browser. An attacker who can entice a user to visit a maliciously crafted URL can cause that user’s browser to run arbitrary scripts, potentially compromising the site’s session cookies, defacing the page, or launching secondary attacks from the victim’s session.

WordPress installations that have the duogeek Simple Amazon Affiliate plugin installed in any version up to 1.0.9. Sites that have not replaced the plugin with a newer release are vulnerable. No vendor‑specific “upgrade” level is officially published, so the sole mitigation at present is to remove or neutralise the msg parameter usage or disable the plugin.

The CVSS score of 6.1 indicates medium severity, while the EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalogue, reflecting a low current exploitation probability. The flaw is exploitable by an unauthenticated attacker through a user‑initiated, link‑based attack vector; any web visitor who follows a malicious link can be compromised without further privileges.