The Amazon Product in a Post plugin stores user input without proper escaping, enabling attackers to embed malicious scripts that are later rendered in the generated pages. This stored cross‑site scripting flaw can allow defacement, session hijacking, or cookie theft, affecting the confidentiality and integrity of the site and its visitors.

All installations of the WordPress plugin "Amazon Product in a Post" from its earliest release up to and including version 5.2.2 are affected. WordPress core itself is not directly impacted, but any public page that displays the plugin’s output can be abused.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of "< 1%" suggests low immediate exploitation likelihood. It is not listed in CISA’s KEV catalog. Attackers need the ability to submit or edit product entries—typically through administrator or editor roles— which if unrestrained could allow injection of malicious scripts that execute in the browsers of all users viewing the affected page.