The Affiliates Manager WordPress plugin, versions 2.9.53 and earlier, suffers from an unauthenticated XSS flaw. Malicious JavaScript can be injected into the site’s output, allowing attackers to hijack user sessions, deface content, or phish credentials. This flaw represents a classic client‑side injection weakness identified as CWE‑79.

The vulnerability affects the wp.insider "Affiliates Manager" plugin distributed for WordPress. Any WordPress installation running the plugin up to and including version 2.9.53 is at risk. No additional software or platform dependencies are required beyond the default WordPress environment.

The CVSS score of 7.1 indicates a high severity. Because the flaw is unauthenticated, an attacker can exploit it from any web browser that visits a maliciously crafted page. The EPSS score is not available, leaving the actual exploitation probability uncertain; however, the lack of a KEV listing suggests no public exploit has been reported yet. Nonetheless, the typical ease of XSS execution, combined with the high severity rating, warrants prompt remediation.