The Coupon Affiliates – Affiliate Plugin for WooCommerce is vulnerable to reflected cross‑site scripting through the commission_summary parameter. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject arbitrary JavaScript that executes when a victim follows a crafted link. If the victim performs the expected action, the injected script can steal session cookies, deface content, or obtain sensitive data. The flaw relies solely on user interaction and does not require prior authentication or privileged access.

WordPress sites that use the Coupon Affiliates – Affiliate Plugin for WooCommerce version 6.3.0 or earlier are affected. The vulnerability applies to all releases up to and including 6.3.0, regardless of custom configuration or usage of the commission_summary parameter.

The flaw carries a CVSS score of 6.1, indicating a moderate severity. Its EPSS score is reported as less than 1 %, suggesting a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The likely attack vector involves an attacker delivering a malicious URL that contains a crafted commission_summary value, which a victim is then lured to click. Successful exploitation requires only that a user visit the URL; no authentication or additional system compromise is needed.