The ClickWhale plugin for WordPress, used for managing and shortening affiliate links, suffers from a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 2.4.1. An attacker can exploit this by crafting a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the context of the victim's browser session.

Successful exploitation can lead to the execution of arbitrary scripts in the context of a user's browser, potentially allowing theft of session cookies, redirection to malicious sites, or other actions limited by the browser's same-origin policy. The vulnerability requires user interaction (clicking a malicious link) and does not require authentication. There is no indication of impact on system availability or integrity beyond the browser context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the ClickWhale plugin and consider disabling or replacing the plugin if possible. Monitoring vendor channels for updates is recommended.