{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/affiliate-toolkit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:affiliate-toolkit:affiliate-toolkit:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-111314"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["affiliate-toolkit – Multi-Network Affiliate \u0026 Amazon Product Display (\u003c= 3.9.2)"],"_cs_severities":["high"],"_cs_tags":["xss","wordpress","plugin"],"_cs_type":"advisory","_cs_vendors":["affiliate-toolkit"],"content_html":"\u003cp\u003eThe affiliate-toolkit - Multi-Network Affiliate \u0026amp; Amazon Product Display plugin for WordPress (versions 3.9.2 and earlier) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the atkp_product_producturl parameter due to insufficient input sanitization and output escaping.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary web scripts in the context of a user's browser session. When the plugin AJAX handler is enabled, unauthenticated attackers can trigger this vulnerability by providing a target product ID. In default configurations, the attack requires contributor-level privileges or higher.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the affiliate-toolkit WordPress plugin to the version patched beyond 3.9.2.\u003c/li\u003e\n\u003cli\u003eAudit existing product URLs stored within the affiliate-toolkit plugin configuration for malicious script injections.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress administrative logs for unusual product creation or modification activity originating from contributor-level accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T06:26:21Z","date_published":"2026-10-28T06:26:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-xss/","summary":"The affiliate-toolkit WordPress plugin contains a stored XSS vulnerability in the atkp_product_producturl parameter, allowing unauthenticated or contributor-level attackers to inject arbitrary web scripts.","title":"affiliate-toolkit: Stored Cross-Site Scripting via atkp_product_producturl (CVE-2026-111314)","url":"https://feed.craftedsignal.io/briefs/2026-10-affiliate-toolkit-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Affiliate-Toolkit","version":"https://jsonfeed.org/version/1.1"}