AffiliateX WordPress Plugin Missing Capability Check Vulnerability Allowing Stored Cross-Site Scripting

A vulnerability exists in the AffiliateX – Amazon Affiliate Plugin for WordPress, specifically in versions 1.0.0 to 1.3.9.3. The issue arises from a missing capability check on the save_customization_settings AJAX action, allowing authenticated attackers with Subscriber-level access and above to inject arbitrary JavaScript. This injected script executes whenever an AffiliateX block is rendered on the site, leading to a stored cross-site scripting vulnerability.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the AffiliateX block.

Remediation

Users can update to version 1.4.0 or a newer patched version to address this vulnerability.