CVE-2025-11799 is a stored cross-site scripting vulnerability in the Affiliate AI Lite WordPress plugin, affecting all versions up to 1.0.1. The flaw exists because the 'asin' shortcode attribute in the affiai_img shortcode does not properly sanitize or escape user input. This allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity impact with network attack vector, low attack complexity, and no user interaction required. The scope is changed, affecting confidentiality and integrity but not availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, potentially leading to unauthorized actions or data exposure for users who view those pages. The impact affects confidentiality and integrity of user data within the affected WordPress site. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Affiliate AI Lite plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.