The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin versions up to 3.6.5 contain a stored cross-site scripting vulnerability (CWE-79) in the atkp_product shortcode. This vulnerability results from improper neutralization of user-supplied input during web page generation, specifically due to insufficient sanitization and escaping of attributes. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and partial confidentiality and integrity impact without availability impact. No patch or official vendor advisory is currently available.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject persistent malicious scripts into pages via the atkp_product shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to partial confidentiality and integrity compromise of user data or session information. There is no reported impact on availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affiliate-toolkit plugin if feasible. Monitor for updates from the vendor or WordPress plugin repository to apply any forthcoming patches promptly.