Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Vendor: cservit Clear all filters
TI-2026-81670 CVE-2026-111255 · GHSA-6wvw-5jhh-gcg4

Arbitrary file upload in affiliate-toolkit WordPress plugin

Priority LOW 35

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00515 Published 2026-10-28 No fix listed CWE-434
TI-2026-81648 CVE-2026-111314 · GHSA-37cc-r8jg-x2q6

Stored cross-site scripting in affiliate-toolkit WordPress plugin

Priority LOW 37

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including,…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00241 Published 2026-10-28 No fix listed CWE-79
TI-2026-10892 CVE-2026-12743 · GHSA-4954-43cr-fhmh

affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

Priority LOW 23

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insuf…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00442 Published 2026-08-14 No fix listed CWE-89
TI-2026-12872 CVE-2026-15296 · GHSA-7pc9-597v-3fmf

affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' shortcode in all versions up to, and including, 3.7.0 due to insuf…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00348 Published 2026-07-10 No fix listed CWE-79
TI-2024-09893 CVE-2024-10675

affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting

Priority LOW 28

The affiliate-toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00482 Published 2024-11-21 No fix listed CWE-79
TI-2024-09483 CVE-2024-10227 · GHSA-6m5m-6cxg-r6c7

affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode

Priority LOW 28

The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atkp_product shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00345 Published 2024-10-29 No fix listed CWE-79
TI-2024-06084 CVE-2024-6562 · GHSA-96xq-492q-g359

affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure

Priority LOW 31

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00586 Published 2024-08-09 No fix listed CWE-200