Affiliate Toolkit EUVD-2026-111563

Exploitation requires injecting into the 'atkp_product_producturl' parameter handled by the plugin. Unauthenticated exploitation is possible ONLY when the plugin's AJAX loading or AJAX handler option is enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) AND the attacker knows a valid product id to render. On a default installation, where that AJAX option is not configured, exploitation instead requires contributor-level access or above. The stored payload only fires when a user subsequently accesses the injected product page, and impact is limited to browser-context script execution (confidentiality/integrity limited, no availability impact). These factors - non-default configuration for the unauthenticated path, otherwise authenticated contributor access, and the need for a victim to view the page - meaningfully constrain real-world risk below the raw 7.2 score.

This is a stored XSS (CWE-79) in the affiliate-toolkit WordPress plugin, rated CVSS 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The vulnerability status is 'no public exploit identified at time of analysis' - the only references are the Wordfence advisory and plugin source-code lines on plugins.trac.wordpress.org, not working exploit code, and there is no KEV listing or EPSS score supplied. The headline PR:N (unauthenticated) rating is conditional and does NOT hold for default installations: per the description, unauthenticated exploitation requires the plugin's AJAX loading/handler option to be enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) plus knowledge of a valid product id; on a default install the flaw instead requires contributor-level access or above. This is an important conflict between the CVSS vector and the description - the CVSS PR:N reflects the best-case (for the attacker) non-default configuration, so treating this as 'unauthenticated against defaults' would overstate real risk. The vuln.today Decision label is 'this_week', not act_now/emergency, and no SSVC automatable/technical-impact fields were provided. Net: a genuine, scope-changing stored XSS worth patching within the week, but real-world exploitability is gated by either a non-default AJAX configuration or at least contributor privileges, so it is a priority-but-not-emergency issue rather than a mass-exploitable unauthenticated RCE-class bug.

An attacker injects a malicious script payload into the 'atkp_product_producturl' parameter, which is stored and later rendered without sufficient escaping. On a site where the plugin's AJAX loading/handler option is enabled, an unauthenticated attacker who knows a product id can plant the payload so it executes in the browser of any user who views the affected product page; on a default site, a contributor-level user injects the payload the same way. No public exploit code was identified, so an attacker would need to craft the request themselves.