Tapfiliate, a WordPress plugin that integrates affiliate marketing data, has a stored cross‑site scripting flaw where user input is not properly escaped before rendering. Malicious scripts can be injected and persist in the plugin’s data store, allowing attackers to execute code in any user’s browser that views affected pages. This can lead to session hijacking, defacement, or distribution of malware.

The issue affects all installations of the Tapfiliate WordPress plugin up through version 3.2.2. The vendor is tapfiliate and the product name is Tapfiliate. WordPress itself is not directly mentioned, so any WordPress site running this plugin and using a vulnerable version is subject to the risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests that automated exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to inject malicious content through the plugin’s administrative interface or a user‑generated field that is stored and later displayed to site visitors. This is inferred, as the public description states a stored XSS flaw but does not detail the exact vector. Overall, the risk is moderate with low exploitation probability.