The Affiliate Reviews plugin for WordPress allows an authenticated attacker with Contributor or higher privileges to inject scripts via the numColumns parameter. This stored XSS flaw is triggered when an attacker submits a malicious value that is later rendered in a page without proper sanitization or escaping, enabling the execution of arbitrary client‑side code in the browsers of any user visiting the injected page. The vulnerability falls under CWE‑79, representing an insecure output handling flaw that can lead to data theft, defacement, or further attacks from the victim’s browser.

WordPress sites that use the Affiliate Reviews plugin, any installation running version 1.0.6 or earlier. The affected component is the plugin’s reviews‑grid block template, where the numColumns field is processed and echoed without sanitization.

The CVSS score of 6.4 classifies this as a moderate‑severity flaw. The EPSS value of less than 1% indicates a very low frequency of exploitation in the wild. The vulnerability is not listed in the KEV catalog. Exploitation requires valid Contributor+. Credentialed access is required; an attacker would need to authenticate to WordPress and submit a malicious review‑grid configuration to inject the script. Once injected, any subsequent page load by any site visitor will run the script in the victim’s browser context.