CVE-2026-111255

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-111255 affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-111255

The affiliate-toolkit plugin for WordPress (versions up to and including 3.9.2 ) is vulnerable to Arbitrary File Upload via the upload_image function. The root cause is insufficient file type validation, specifically a weak Content-Type prefix check combined with extension derivation from an atta...

CVE-2026-111255 affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

EUVD-2026-111574

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-111314

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-111314

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress (versions

CVE-2026-111314 affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-111563

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-111255: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to…

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

WordPress Affiliate Toolkit arbitrary file upload vulnerability

WordPress Affiliate Toolkit versions 3.9.2 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient validation of file types in the uploadimage function, weak checks on Content-Type prefixes, and the derivation of file extensions from URL paths...

PT-2026-127801

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload image function. This is due to insufficient file type validation in upload image due to a weak Content-Ty...

PT-2026-127788

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp product producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes...

WordPress affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin affiliate-toolkit versions = 3.9.2...

WordPress affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin affiliate-toolkit versions = 3.9.2...

CVE-2026-110179

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

EUVD-2026-102697

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

CVE-2026-110179 affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

CVE-2026-110179

The affiliate-toolkit WordPress plugin (versions before 3.8.9 ) is vulnerable to SQL injection because it fails to validate user-supplied sort values against an allowlist before including them in database queries. This flaw is reachable via an administrative list screen that only requires editor-...

CVE-2026-110179 affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...