Improper neutralization of input during web page generation enables a reflected XSS flaw (CWE-79) in two AA‑Team WordPress plugins. The vulnerability allows an attacker to inject malicious JavaScript that is executed in the victim’s browser when a crafted request is processed by the plugin.

Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) from versions without a known fix up to 1.2, and Woocommerce Sales Funnel Builder from versions without a known fix up to 1.1. These plugins are distributed by AA‑Team and are commonly used on WordPress installations that include WPBakery Page Builder or WooCommerce.

The CVSS score of 7.1 indicates a moderate risk, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by crafting a URL or submitting a form that includes malicious script content reflected by the plugin, requiring only that a victim visit the affected page. The impact is limited to the victim’s browser and does not provide direct server‑side access.