Executive brief
The affiliate-toolkit plugin for WordPress, which helps site owners display Amazon products and manage affiliate links, contains a security flaw. This vulnerability allows users with contributor-level access or higher to inject malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or data theft.
Technical details
The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes within the 'atkp_product' shortcode. This vulnerability exists in all versions up to and including 3.7.0 and represents a bypass for a previous fix (CVE-2024-10227). An authenticated attacker with contributor-level privileges or higher can exploit this by embedding malicious scripts into a post or page via the shortcode. These scripts are then stored on the server and executed in the browser of any user who views the compromised content. A patch has been identified in changeset 3227483.
Affected products
- cservit affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0
Timeline
- 2026-07-10: disclosed: CVE published by Wordfence