# CVE-2026-111314: Affiliate Toolkit stored cross-site scripting via product URL parameter

Source: https://junglewise.ai/threats/cve-2026-111314-the-affiliate-toolkit-multi-network-affiliate-amazon-product  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-111314 · Severity: high · CVSS 7.2 · Published 2026-10-28

The Affiliate Toolkit WordPress plugin allows attackers to inject malicious scripts into product display pages through an unprotected URL parameter. When a user visits an affected page, the injected script executes in their browser, potentially stealing session tokens, redirecting users to phishing sites, or performing unauthorized actions. Unauthenticated attackers can exploit this if AJAX loading is enabled and they know a product ID; otherwise, attackers with contributor privileges can exploit it.

Technologies: [Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display](https://junglewise.ai/threats/technologies/affiliate-toolkit-multi-network-affiliate-amazon-product-display). Vendors: [Affiliate-Toolkit](https://junglewise.ai/threats/vendors/affiliate-toolkit).

## Quick answers

**Is CVE-2026-111314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111314 being exploited in the wild.

**How severe is CVE-2026-111314?** High severity, with a CVSS score of 7.2, published 28 October 2026.

**Which products and versions are affected?** Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display up to and including 3.9.2.

**Is there a fix for CVE-2026-111314?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111314 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111314?** Check whether you run Affiliate-Toolkit Affiliate Toolkit – Multi-Network Affiliate & Amazon Product Display at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'atkp_product_producturl' parameter in the Affiliate Toolkit plugin lacks sufficient input sanitization and output escaping, allowing stored XSS injection. Exploitation by unauthenticated attackers requires that AJAX loading or AJAX handler options are enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) and knowledge of a valid product ID; on default installations, contributor-level access or higher is needed. The injected payload persists in the database and executes whenever any user accesses the affected page.

## Affected products

- Affiliate Toolkit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display up to and including 3.9.2

## Timeline

- 2026-10-28: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/atkp_posttypes_product.php](https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/atkp_posttypes_product.php)
- [https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php](https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/tags/3.9.2/includes/basics/ATKPTools.php)

## Related threats

- [affiliate-toolkit arbitrary file upload in product image handler](https://junglewise.ai/threats/cve-2026-111255-the-affiliate-toolkit-multi-network-affiliate-amazon-product)
- [Affiliate Toolkit time-based SQL injection in orderby parameter](https://junglewise.ai/threats/cve-2026-12743-affiliate-toolkit-time-based-sql-injection-in-orderby-parameter)