affiliate-toolkit: Stored Cross-Site Scripting via atkp_product_producturl (CVE-2026-111314)
The affiliate-toolkit WordPress plugin contains a stored XSS vulnerability in the atkp_product_producturl parameter, allowing unauthenticated or contributor-level attackers to inject arbitrary web scripts.
CVE search metadata
CVE search record: CVE-2026-111314. Severity: high. CVSS: 7.2. KEV: no. Product: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (<= 3.9.2). Brief: affiliate-toolkit: Stored Cross-Site Scripting via atkp_product_producturl (CVE-2026-111314). Brief link: https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-xss/
Triage facts
Revision 1- Applicability
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (<= 3.9.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 06:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display plugin for WordPress (versions 3.9.2 and earlier) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the atkp_product_producturl parameter due to insufficient input sanitization and output escaping.
Impact
Successful exploitation allows for the execution of arbitrary web scripts in the context of a user's browser session. When the plugin AJAX handler is enabled, unauthenticated attackers can trigger this vulnerability by providing a target product ID. In default configurations, the attack requires contributor-level privileges or higher.
Recommendation
- Update the affiliate-toolkit WordPress plugin to the version patched beyond 3.9.2.
- Audit existing product URLs stored within the affiliate-toolkit plugin configuration for malicious script injections.
- Monitor WordPress administrative logs for unusual product creation or modification activity originating from contributor-level accounts.
Immediate actions
Identify all WordPress instances running affiliate-toolkit versions 3.9.2 or older
Threat Hunt
Inspect plugin configuration for suspicious content in atkp_product_producturl
Data: WordPress database entries for affiliate-toolkit plugin settings, Web server access logs showing POST requests to plugin AJAX endpoints
Mitigations
Upgrade affiliate-toolkit to the latest patched version
CVE-2026-111314