The vulnerability is an improperly neutralized user input in the Woocommerce Envato Affiliates plugin that results in reflected cross‑site scripting. An attacker who can supply crafted input can have the malicious script executed in the browsers of any user who views the affected page, potentially allowing theft of user credentials, session hijacking, or injection of additional malicious content.

The affected product is the Woocommerce Envato Affiliates plugin from AA‑Team, versions from the initial release up to and including 1.2.1. Any WordPress site running this plugin within that version range is potentially vulnerable.

The CVSS score of 7.1 places it in the high‑severity range, but the EPSS score is less than 1%, indicating that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request that includes the attacker’s payload, with the exploitation requiring that the victim view a page generated by the vulnerable plugin. A successful exploitation gives the attacker the ability to execute arbitrary scripts in the context of the site’s users.