The AFI – The Easiest Integration Plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input when generating web pages. Specifically, the plugin uses add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling attackers to inject malicious scripts. This vulnerability affects all versions up to 1.92.0 and can be exploited by unauthenticated attackers who can trick users into clicking malicious links, leading to script execution in the victim's browser. The CVSS 3.1 base score is 6.1, reflecting a network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity without availability impact. No patch or official remediation guidance is currently provided.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to partial disclosure or modification of sensitive information accessible to the user. The attack requires user interaction (clicking a crafted link) and does not impact system availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the AFI plugin if feasible, or apply manual mitigations such as input validation and output escaping if possible. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor the vendor's channels for updates and apply official patches promptly once available.