A comment input field in the ThirstyAffiliates plugin allows unauthenticated users to inject arbitrary script content via the <ta> tag, leading to stored cross‑site scripting within comment blocks. The injected code runs whenever a visitor loads a page that displays the affected comment, compromising the confidentiality and integrity of the site’s users. This is a classic example of CWE‑79, a reflected or stored injection flaw that can be used to steal credentials or deface a web page.

The vulnerability affects all versions of the ThirstyAffiliates WordPress plugin up to and including version 3.12.1, specifically when the site uses block‑based themes such as Twenty Twenty‑Five where comment content is output through render_block. Site owners running the plugin on older or non‑block themes may be unaffected.

The CVSS score of 7.2 classifies this as a high‑severity issue. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that while exploitation is possible, it has not been broadly observed. The attack path requires an unauthenticated user to post a comment that is auto‑approved, which may be mitigated by requiring manual approval. Once a comment is approved, subsequent crafted comments are automatically approved and inserted into the page, enabling the stored XSS attack. Administrators should assume that all visitors can potentially trigger the vulnerability if comment moderation settings allow automatic approval on block themes.