Improper neutralization of user input in the Add & Replace Affiliate Links for Amazon plugin allows attackers to inject malicious scripts that are stored by the system and later executed when a page is rendered. The weakness, identified as CWE‑79, means that any user who visits the affected page will receive and run the injected code in the context of their browser, potentially allowing the attacker to alter the displayed content or to hijack browser behavior.

The vulnerability affects the WordPress plugin Add & Replace Affiliate Links for Amazon released by The Website Flip, versions up to and including 1.0.6.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of < 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to submit data through the plugin’s interface—likely requiring an account with permission to modify plugin settings—to store malicious payloads. Once stored, the payload will affect every visitor rendering the compromised content.