VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 13 known issues Latest disclosed Apr 22, 2025

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Vulnerabilities

Review known vulnerability records for the WordPress plugin affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (`affiliate-toolkit-starter`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-46231 and CVE-2024-10675, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
13
High or Critical
0
Patch Coverage
100%
Last Updated
Apr 30, 2025
Priority CVE Quick Links

Fast paths into affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
12
CVE-2023-5877 Medium 3.4.3
CVE-2023-5877 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Server-Side Request Forgery

affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery

CVE-2024-10227 Medium 3.6.6
CVE-2024-10227 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Stored Cross-Site Scripting

affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode

CVE-2024-29817 Medium 3.4.6
CVE-2024-29817 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Stored Cross-Site Scripting

affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings

CVE-2024-1851 Medium 3.5.5
CVE-2024-1851 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Vulnerability

affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list

CVE-2024-10675 Medium 3.6.8
CVE-2024-10675 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Cross-Site Scripting

affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting

CVE-2023-46086 Medium 3.4.4
CVE-2023-46086 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Cross-Site Scripting

affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scripting via keyword

CVE-2023-23786 Medium 3.3.4
CVE-2023-23786 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Stored Cross-Site Scripting

affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting

CVE-2024-6562 Medium 3.6
CVE-2024-6562 affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display Vulnerability

affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
13 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2025-46231 and CVE-2024-10675
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-46231
CVE-2025-46231: affiliate-toolkit <= 3.7.3 - Cross-Site Request Forgery

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.7.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated att...

Published
Apr 22, 2025
Patched Release
3.7.4
Affected Versions
Versions up to 3.7.3
Next Step
Update to 3.7.4 or newer if supported.
Open CVE-2025-46231 Report Open CVE Reference
Plugin Medium Patched: Yes
affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' shortcode in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user suppl...

Published
Jan 23, 2025
Patched Release
3.7.1
Affected Versions
Versions up to 3.7.0
Next Step
Update to 3.7.1 or newer if supported.
Open Full Report
Plugin Medium Patched: Yes CVE-2024-10675
CVE-2024-10675: affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting

The affiliate-toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

Published
Nov 20, 2024
Patched Release
3.6.8
Affected Versions
Versions up to 3.6.7
Next Step
Update to 3.6.8 or newer if supported.
Open CVE-2024-10675 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-10227
CVE-2024-10227: affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode

The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atkp_product shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

Published
Oct 28, 2024
Patched Release
3.6.6
Affected Versions
Versions up to 3.6.5
Next Step
Update to 3.6.6 or newer if supported.
Open CVE-2024-10227 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-6562
CVE-2024-6562: affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due display_errors being set to true . This makes it possible for unauthenticated attackers to retrieve the full path...

Published
Aug 08, 2024
Patched Release
3.6
Affected Versions
Versions up to 3.5.5
Next Step
Update to 3.6 or newer if supported.
Open CVE-2024-6562 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-37205
CVE-2024-37205: affiliate-toolkit <= 3.4.4 - Unauthenticated Sensitive Information Exposure via Logs

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.4 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensiti...

Published
Jun 20, 2024
Patched Release
3.4.5
Affected Versions
Versions up to 3.4.4
Next Step
Update to 3.4.5 or newer if supported.
Open CVE-2024-37205 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-29817
CVE-2024-29817: affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings

The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various ratings postmeta parameters in versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Published
Mar 25, 2024
Patched Release
3.4.6
Affected Versions
Versions up to 3.4.5
Next Step
Update to 3.4.6 or newer if supported.
Open CVE-2024-29817 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-2298
CVE-2024-2298: affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, wi...

Published
Mar 07, 2024
Patched Release
3.5.5
Affected Versions
Versions up to 3.5.4
Next Step
Update to 3.5.5 or newer if supported.
Open CVE-2024-2298 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1851
CVE-2024-1851: affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with...

Published
Mar 07, 2024
Patched Release
3.5.5
Affected Versions
Versions up to 3.5.4
Next Step
Update to 3.5.5 or newer if supported.
Open CVE-2024-1851 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-5877
CVE-2023-5877: affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.2 via the affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint. This makes it possible for unauthenticated att...

Published
Dec 11, 2023
Patched Release
3.4.3
Affected Versions
Versions up to 3.4.2
Next Step
Update to 3.4.3 or newer if supported.
Open CVE-2023-5877 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-46086
CVE-2023-46086: affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scripting via keyword

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the keyword parameter in versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthe...

Published
Nov 28, 2023
Patched Release
3.4.4
Affected Versions
Versions up to 3.4.3
Next Step
Update to 3.4.4 or newer if supported.
Open CVE-2023-46086 Report Open CVE Reference
Plugin Low Patched: Yes CVE-2023-45105
CVE-2023-45105: affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.9 - Open Redirect via atkpout.php

The affiliate-toolkit – WordPress Affiliate Plugin is vulnerable to Open Redirect in versions up to, and including, 3.3.9. This is due to insufficient validation on the redirect url supplied via the 'url' parameter in atkpout.php. This makes it possible for unauthenticated attack...

Published
Oct 06, 2023
Patched Release
3.4.0
Affected Versions
Versions up to 3.3.9
Next Step
Update to 3.4.0 or newer if supported.
Open CVE-2023-45105 Report Open CVE Reference