Unauthenticated Cross Site Scripting was discovered in SUMO Affiliates Pro plugin versions up to 11.7.0. The flaw permits an attacker to inject arbitrary JavaScript into pages that users view through the plugin. When executed in a victim’s browser, the malicious script can steal cookies, access session data, and act as the user, potentially leading to credential theft, phishing, or further network attacks.

All installations using Fantastic Plugins’ SUMO Affiliates Pro version 11.7.0 or earlier are affected. No other vendors or product variants are reported to be vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high risk for impacted sites. Because the vulnerability is unauthenticated, any user who can load a page containing the plugin can drive the attack. EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the ease of injecting script payloads make exploitation plausible.