What’s Vulnerable › Products
cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Latest cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display vulnerabilities
- CVE-2026-111255 — affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter (CVSS 7.5)
- CVE-2026-111314 — affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter (CVSS 7.2)
- CVE-2026-110179 — affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter (CVSS 6.8)
- CVE-2026-86787 — Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive (CVSS 7.2)
- CVE-2026-42721 — WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability (CVSS 7.6)
- CVE-2026-12743 — affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
- CVE-2026-15296 — affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2026-6169 — affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution (CVSS 7.2)
- CVE-2025-46231 — WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8)
- CVE-2024-10675 — affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2024-10227 — affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode (CVSS 6.4)
- CVE-2024-6562 — affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure (CVSS 5.3)
- CVE-2024-37205 — WordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3)
- CVE-2024-29817 — WordPress affiliate-toolkit – WordPress Affiliate Plugin plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2024-2298 — affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product (CVSS 4.3)
- CVE-2024-1851 — affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list (CVSS 6.5)
- CVE-2023-5877 — affiliate-toolkit < 3.4.3 - Unauthenticated SSRF (CVSS 9.8)
- CVE-2023-45105 — WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection (CVSS 6.1)
- CVE-2023-46086 — WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2023-23786 — WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)