The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress suffers from a reflected XSS vulnerability (CWE-79) via the commission_summary parameter. This occurs because the plugin does not properly sanitize or escape user input before including it in web pages. Attackers can exploit this by crafting malicious URLs that, when visited by a user, execute arbitrary JavaScript in the context of the affected site. This vulnerability affects all plugin versions up to and including 0.6.3.0. There is no information about an available patch or vendor advisory indicating a fix.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session when they interact with a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of cookies or session tokens, or manipulation of the displayed content. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing the commission_summary parameter in affected versions of the plugin. Monitoring vendor channels for updates and applying patches promptly when released is recommended.