Threats tagged 'ghsa-37cc-r8jg-x2q6'

The affiliate-toolkit WordPress plugin (up to version 3.9.2) is vulnerable to stored cross-site scripting (XSS) via the 'atkp_product_producturl' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the plugin's AJAX loading or AJAX handler feature to be enabled, or contributor-level access if these features are disabled by default.