The Amazon Scraper WordPress plugin is vulnerable to a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation. An attacker can craft a forged request that an administrator unknowingly submits, allowing the attacker to change plugin settings and inject arbitrary web scripts that are stored on the site. This results in a Stored Cross‑Site Scripting (XSS) that persists until the settings are cleared, potentially enabling an attacker to steal user credentials, deface the site, or redirect visitors to malicious domains.

WordPress sites that have installed submone Amazon Scraper version 1.1 or earlier are affected. The vulnerability exists in all releases up to and including 1.1, as the nonce check is absent in the settings update handler of the plugin.

The CVSS score is 4.3, indicating a moderate impact. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is web‑based and requires social engineering; an attacker must convince an administrator to trigger the request, such as by clicking a link. Once the stored script is executed, it runs in the context of any user who visits the infected page, providing full cross‑site scripting capabilities.