CVE-2024-9349 is a reflected cross-site scripting vulnerability in the Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress, affecting all versions up to 5.4.2. The issue stems from the plugin's use of the add_query_arg function without appropriate escaping of URL parameters, allowing injection of arbitrary web scripts. This vulnerability can be triggered when a user is tricked into clicking a maliciously crafted link, leading to script execution in the context of the affected site. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting a medium severity level.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website via reflected XSS. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. Availability is not affected. The attack requires user interaction (clicking a crafted link). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links and consider disabling or replacing the plugin if possible. Monitor the vendor's channels for updates and apply patches promptly once released.