CVE-2023-46086: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in SERVIT Software Solutions' affiliate-toolkit WordPress Affiliate Plugin, identified as CVE-2023-46086. The vulnerability affects versions up to and including 3.4.3 of the plugin. The issue was initially reported on April 27, 2023, by researcher LEE SE HYOUNG and was publicly disclosed on November 28, 2023 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) issue, categorized under CWE-79. It received a CVSS v3.1 base score of 6.1 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a higher CVSS score of 7.1 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows attackers to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which will be executed when guests visit the site. This reflected XSS vulnerability can potentially compromise the security of website visitors (Patchstack).

The vulnerability has been fixed in version 3.4.4 of the affiliate-toolkit WordPress plugin. Users are advised to update to version 3.4.4 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).