CVE-2024-12321: Reflected Cross-Site Scripting (XSS) vulnerability exists in the WC Affiliate WordPress plugin, versions up to 2.3.9. This vulnerability stems from insufficient sanitization and escaping of a parameter before it's outputted back into the page. An attacker could exploit this vulnerability to execute malicious scripts in the context of a user's browser, potentially targeting high-privilege users like administrators. With an SVRS of 30, the risk is moderate, indicating a potential but not immediate threat. Successful exploitation could lead to account compromise or other unauthorized actions. While the CVSS score is 0, the SVRS provides a more nuanced view of the risk, incorporating real-world threat intelligence. This highlights the importance of promptly updating the WC Affiliate plugin to mitigate the risk.