The Affiliates Manager WordPress plugin before 2.9.0 does not validate sanitise and escape the IP address of requests logged by the click tracking feature allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.