VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 14 known issues Latest disclosed May 26, 2026

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Vulnerabilities

Review known vulnerability records for the WordPress plugin affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (`affiliate-toolkit-starter`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-6169 and CVE-2025-46231, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
14
High or Critical
1
Patch Coverage
100%
Last Updated
Jun 02, 2026
Related Security Guides

Use these guides while reviewing affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
13
1. Match the Package
Confirm the installed WordPress plugin slug is affiliate-toolkit-starter before acting on any CVE from this cluster.
2. Sort by Severity
Start with 1 high or critical record, then review medium and unrated findings with public references.
3. Check Patch Evidence
14 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2026-6169 High
Remote Code Execution remediation for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

Affected range: Versions up to 3.8.4. Fixed version is not listed yet.

CVE-2023-5877 Medium
Server-Side Request Forgery remediation for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

Affected range: Versions up to 3.4.2. Fixed version: 3.4.3.

CVE-2024-10227 Medium
Stored Cross-Site Scripting remediation for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

Affected range: Versions up to 3.6.5. Fixed version: 3.6.6.

CVE-2024-29817 Medium
Stored Cross-Site Scripting remediation for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

Affected range: Versions up to 3.4.5. Fixed version: 3.4.6.

Priority CVE Quick Links

Fast paths into affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
13
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2026-6169
affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
 Remote Code Execution Versions up to 3.8.4 No patch listed CVSS 7.2
CVE-2023-5877
affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery
 Server-Side Request Forgery Versions up to 3.4.2 3.4.3 CVSS 6.5
CVE-2024-10227
affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scriptin...
 Stored Cross-Site Scripting Versions up to 3.6.5 3.6.6 CVSS 6.4
CVE-2024-29817
affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via...
 Stored Cross-Site Scripting Versions up to 3.4.5 3.4.6 CVSS 6.4
CVE-2024-1851
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via...
 Vulnerability Versions up to 3.5.4 3.5.5 CVSS 6.3
CVE-2024-10675
affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 3.6.7 3.6.8 CVSS 6.1
CVE-2023-46086
affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scrip...
 Cross-Site Scripting Versions up to 3.4.3 3.4.4 CVSS 6.1
CVE-2023-23786
affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.3 - Authenticated (Editor+) St...
 Stored Cross-Site Scripting Versions up to 3.3.3 3.3.4 CVSS 5.5
CVE-2026-6169 High No patch listed
CVE-2026-6169 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Remote Code Execution

affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution

CVE-2023-5877 Medium 3.4.3
CVE-2023-5877 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Server-Side Request Forgery

affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery

CVE-2024-10227 Medium 3.6.6
CVE-2024-10227 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Stored Cross-Site Scripting

affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode

CVE-2024-29817 Medium 3.4.6
CVE-2024-29817 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Stored Cross-Site Scripting

affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings

CVE-2024-1851 Medium 3.5.5
CVE-2024-1851 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Vulnerability

affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list

CVE-2024-10675 Medium 3.6.8
CVE-2024-10675 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Cross-Site Scripting

affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting

CVE-2023-46086 Medium 3.4.4
CVE-2023-46086 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Cross-Site Scripting

affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scripting via keyword

CVE-2023-23786 Medium 3.3.4
CVE-2023-23786 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Stored Cross-Site Scripting

affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
14 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2026-6169 and CVE-2025-46231
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: No CVE-2026-6169
CVE-2026-6169: affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and execu...

Published
May 26, 2026
Patched Release
Not published
Affected Versions
Versions up to 3.8.4
Next Step
Open the full report for remediation notes and references.
Review CVE-2026-6169 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-46231
CVE-2025-46231: affiliate-toolkit <= 3.7.3 - Cross-Site Request Forgery

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.7.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated att...

Published
Apr 22, 2025
Patched Release
3.7.4
Affected Versions
Versions up to 3.7.3
Next Step
Update to 3.7.4 or newer if supported.
Review CVE-2025-46231 fixed version details Open CVE Reference
Plugin Medium Patched: Yes
affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user suppl...

Published
Jan 23, 2025
Patched Release
3.7.1
Affected Versions
Versions up to 3.7.0
Next Step
Update to 3.7.1 or newer if supported.
Review affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display vulnerability details
Plugin Medium Patched: Yes CVE-2024-10675
CVE-2024-10675: affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting

The affiliate-toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

Published
Nov 20, 2024
Patched Release
3.6.8
Affected Versions
Versions up to 3.6.7
Next Step
Update to 3.6.8 or newer if supported.
Review CVE-2024-10675 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-10227
CVE-2024-10227: affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode

The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atkp_product shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

Published
Oct 28, 2024
Patched Release
3.6.6
Affected Versions
Versions up to 3.6.5
Next Step
Update to 3.6.6 or newer if supported.
Review CVE-2024-10227 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-6562
CVE-2024-6562: affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due display_errors being set to true . This makes it possible for unauthenticated attackers to retrieve the full path...

Published
Aug 08, 2024
Patched Release
3.6
Affected Versions
Versions up to 3.5.5
Next Step
Update to 3.6 or newer if supported.
Review CVE-2024-6562 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-37205
CVE-2024-37205: affiliate-toolkit <= 3.4.4 - Unauthenticated Sensitive Information Exposure via Logs

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.4 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensiti...

Published
Jun 20, 2024
Patched Release
3.4.5
Affected Versions
Versions up to 3.4.4
Next Step
Update to 3.4.5 or newer if supported.
Review CVE-2024-37205 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-29817
CVE-2024-29817: affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings

The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various ratings postmeta parameters in versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Published
Mar 25, 2024
Patched Release
3.4.6
Affected Versions
Versions up to 3.4.5
Next Step
Update to 3.4.6 or newer if supported.
Review CVE-2024-29817 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-2298
CVE-2024-2298: affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, wi...

Published
Mar 07, 2024
Patched Release
3.5.5
Affected Versions
Versions up to 3.5.4
Next Step
Update to 3.5.5 or newer if supported.
Review CVE-2024-2298 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1851
CVE-2024-1851: affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with...

Published
Mar 07, 2024
Patched Release
3.5.5
Affected Versions
Versions up to 3.5.4
Next Step
Update to 3.5.5 or newer if supported.
Review CVE-2024-1851 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-5877
CVE-2023-5877: affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.2 via the affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint. This makes it possible for unauthenticated att...

Published
Dec 11, 2023
Patched Release
3.4.3
Affected Versions
Versions up to 3.4.2
Next Step
Update to 3.4.3 or newer if supported.
Review CVE-2023-5877 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-46086
CVE-2023-46086: affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scripting via keyword

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the keyword parameter in versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthe...

Published
Nov 28, 2023
Patched Release
3.4.4
Affected Versions
Versions up to 3.4.3
Next Step
Update to 3.4.4 or newer if supported.
Review CVE-2023-46086 fixed version details Open CVE Reference