CVE-2026-15296 is a stored cross-site scripting vulnerability (CWE-79) in the affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes in the 'atkp_product' shortcode. Authenticated attackers with contributor-level privileges or above can exploit this to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This issue affects all versions up to and including 3.7.0 and serves as a bypass to the earlier CVE-2024-10227 vulnerability. The CVSS v3.1 base score is 6.4, indicating a medium severity level. No official patch or remediation guidance has been published as of the data provided.

Successful exploitation allows authenticated users with contributor-level access or higher to inject persistent malicious scripts into pages via the 'atkp_product' shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions with the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher access to trusted users only. Consider disabling or removing the 'atkp_product' shortcode if feasible to reduce exposure. Monitor for updates from the vendor regarding patches or official mitigations.