Affiliate-Toolkit – Multi-Network Affiliate & Amazon Product Display (<= 3.9.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/affiliate-toolkit--multi-network-affiliate--amazon-product-display--3.9.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 06:26:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgaffiliate-toolkit: Stored Cross-Site Scripting via atkp_product_producturl (CVE-2026-111314)https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-xss/Wed, 28 Oct 2026 06:26:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-xss/The affiliate-toolkit WordPress plugin contains a stored XSS vulnerability in the atkp_product_producturl parameter, allowing unauthenticated or contributor-level attackers to inject arbitrary web scripts.The affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display plugin for WordPress (versions 3.9.2 and earlier) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the atkp_product_producturl parameter due to insufficient input sanitization and output escaping.

Impact

Successful exploitation allows for the execution of arbitrary web scripts in the context of a user's browser session. When the plugin AJAX handler is enabled, unauthenticated attackers can trigger this vulnerability by providing a target product ID. In default configurations, the attack requires contributor-level privileges or higher.

Recommendation

  • Update the affiliate-toolkit WordPress plugin to the version patched beyond 3.9.2.
  • Audit existing product URLs stored within the affiliate-toolkit plugin configuration for malicious script injections.
  • Monitor WordPress administrative logs for unusual product creation or modification activity originating from contributor-level accounts.
]]>highadvisoryxsswordpressplugin