A cross‑site request forgery flaw in the Easy Amazon Product Information plugin allows an attacker to trick a legitimate user into submitting a crafted request that stores malicious script code in the database. Once stored, the payload is executed in the browsers of any visitor to the site, resulting in a stored cross‑site scripting vulnerability.

The vulnerability affects all installations of the jensmueller Easy Amazon Product Information plugin version 4.0.1 or earlier.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, requiring an authenticated user to submit the malicious request through the vulnerable form, after which the script is executed for all site visitors.