The vulnerability is an unauthenticated Cross Site Scripting flaw present in versions of the WordPress Coupon Affiliates plugin up to 7.5.3. It permits an attacker to inject arbitrary JavaScript that executes in the browser of any visitor who accesses the vulnerable functionality. This could let an attacker manipulate the page content, intercept input, or perform other actions within the context of the site. The weakness is a classic input validation failure (CWE‑79).

WordPress sites that have the RelyWP Coupon Affiliates plugin installed, versions 7.5.3 or earlier. The flaw affects all installations regardless of user role or authentication status, as the vulnerable input can be accessed from publicly reachable URLs.

CVSS base score of 7.1 denotes high severity. EPSS is less than 1%, so the probability of exploitation in the wild is currently low, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated attacker sending a crafted request or link that triggers the plugin to echo unsanitized data to the browser. The attacker does not need elevated privileges or prior access; visiting a malicious link or injecting content via the plugin’s public interfaces suffices. Although the exploitation window may be limited, the potential impact remains significant if an attacker can target high‑traffic sites.