The vulnerability is an improper neutralization of input during web page generation, permitting reflected cross‑site scripting. When a crafted query parameter is sent to the plugin, the server echoes the value directly into the generated page without proper sanitization, enabling an attacker to inject malicious JavaScript that will run in the victim's browser when the page is viewed.

The affected product is the WordPress Affiliate Links Manager plugin developed by winking. All installations using version 1.0 or earlier are impacted; no specific revision numbers are listed beyond the <= 1.0 boundary.

The CVSS score of 5.8 indicates a moderate severity, while an EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Based on the nature of reflected XSS, the likely attack vector is an HTTP request containing a malicious query string or form input that the user is encouraged to click on, implying that the attacker needs the victim to interact with the crafted URL.