The WC Affiliate – WooCommerce Affiliate Plugin (versions up to 2.4) suffers from a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject malicious scripts through any parameter, which execute when a user interacts with a crafted link. The vulnerability is confirmed and published with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website for users who click on malicious links. This can result in limited confidentiality and integrity impacts such as theft of user session data or manipulation of displayed content. There is no impact on system availability. The vulnerability affects all users of the plugin versions up to 2.4 and requires user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links received from untrusted sources and consider disabling or replacing the affected plugin. Monitoring vendor channels for updates is recommended.