CVE-2026-7330 is a stored cross-site scripting vulnerability in the Auto Affiliate Links plugin for WordPress. The issue arises from insufficient sanitization of the 'url' POST parameter in the aal_url_stats_save_action() function and missing output escaping in the aal_display_clicks() function. This allows unauthenticated attackers to inject arbitrary scripts into the admin statistics page by leveraging a publicly accessible AJAX endpoint registered with wp_ajax_nopriv_. When an administrator views this page, the malicious script executes in their browser context, potentially compromising administrative functions or data.

Successful exploitation enables unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's browser session. This can lead to theft of administrative credentials, session hijacking, or unauthorized actions performed with administrator privileges. The vulnerability affects the confidentiality and integrity of the affected WordPress site but does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin interface and monitor for suspicious activity. Consider disabling or removing the Auto Affiliate Links plugin if it is not essential. Avoid visiting the admin statistics page from untrusted networks or devices. Follow the vendor's updates closely for any released patches or official mitigations.