The affmngr Affiliates Manager Google reCAPTCHA Integration plugin contains a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.0.6. The vulnerability allows attackers to trick authenticated users into submitting unwanted requests, which can result in stored malicious scripts being executed in the context of the victim's browser. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to medium level.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute malicious scripts in the context of affected users. This can compromise user data confidentiality, integrity, and availability. The CSRF nature means attackers can induce victims to perform unintended actions without their consent. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.