This vulnerability in AffiliateWP – External Referral Links (<= 1.2.0) involves improper input neutralization leading to stored cross-site scripting. An attacker with high privileges and requiring user interaction can inject malicious scripts that persist and execute when viewed by others, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS vector indicates the attack is network-based with low complexity but requires high privileges and user interaction. There is no vendor advisory or patch information provided at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users who view the affected pages, potentially leading to data disclosure, modification, or denial of service. The impact affects confidentiality, integrity, and availability but requires high privileges and user interaction, limiting exploitation scope. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to external referral links. Avoid clicking on untrusted referral links within the plugin context. Follow vendor channels for updates on patches or mitigations.