The Auto Affiliate Links plugin for WordPress contains a stored XSS flaw in versions up to and including 6.8.8. Unauthenticated attackers can submit arbitrary JavaScript through the 'url' POST parameter, which is later echoed into the admin statistics page without any output escaping. This flaw allows a malicious script to execute in the browser of any administrator who views the affected page, potentially leading to session hijacking, credential theft, or other malicious actions performed under the administrator’s authority.

The vulnerability affects thedark's Auto Affiliate Links plugin for WordPress, specifically all releases dated 6.8.8 or earlier. WordPress sites running any of those releases are at risk. No other vendors or products are impacted according to the CNA record.

The CVSS score of 7.2 categorizes this flaw as high severity, and the EPSS score is not available, indicating no published data on exploitation frequency. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit it through a publicly exposed AJAX endpoint that requires no authentication, making the attack vector remote and easy to reach. By injecting script into the stored link value, an attacker can run arbitrary code in the administrator’s browser whenever the statistics page is accessed.