This vulnerability involves improper input sanitization in the 'Add & Replace Affiliate Links for Amazon' WordPress plugin, leading to stored cross-site scripting. An attacker with high privileges and requiring user interaction can inject malicious scripts that persist in the application. The vulnerability affects all versions up to 1.0.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability partially. No patch or official fix has been documented yet.

Successful exploitation can result in stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users. This can lead to partial loss of confidentiality, integrity, and availability of the affected system or user data. The attack requires high privileges and user interaction, which limits the ease of exploitation. No known exploits are currently reported in the wild.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access and avoid interacting with untrusted input in the plugin. Monitor for vendor updates and apply official patches once released.