CVE-2026-111314: affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by unauthenticated attackers requires that the plugin's AJAX loading / AJAX handler option is enabled (atkpoptions::getajaxloadingenabled() || getajaxhandlerenabled()) and the attacker knows a product id to render. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.
Affected Software
Event History
Frequently Asked Questions
When can an unauthenticated attacker exploit this issue?
Unauthenticated exploitation requires the plugin's AJAX loading or AJAX handler option to be enabled and the attacker to know a product ID that can be rendered. Under those conditions, an attacker can inject script through the atkp_product_producturl parameter.
Is a default installation exposed to unauthenticated exploitation?
No. On a default installation where the relevant AJAX options are not configured, exploitation requires contributor-level access or higher.
What configuration should be reviewed while patching is pending?
Review whether AJAX loading or the AJAX handler is enabled in affiliate-toolkit. Disabling those options removes the stated prerequisite for unauthenticated exploitation, though users with contributor-level access or higher remain relevant on default configurations.
What is the impact if exploitation succeeds?
Injected JavaScript is stored in a page and executes when a user accesses that injected page. The supplied severity vector indicates low-impact confidentiality and integrity effects, with no availability impact.