affiliate-toolkit Plugin XSS and File Upload Flaws

Arbitrary file upload in the Affiliate Toolkit WordPress plugin through 3.9.2 lets authenticated contributor-level users place files that may be executable onto the server, which can lead to remote code execution, though the path is only reachable when the plugin's 'import product image' option is enabled. The upload_image routine in ATKPTools.php validates uploads with a weak Content-Type prefix check and derives the file extension from the attacker-controlled URL path with no dangerous-extension stripping, so a crafted image URL attached to a product post can carry an executable extension past the check. No CISA KEV entry or public exploit code is associated with this CVE at time of analysis, and the required authenticated foothold, non-default setting and high attack complexity temper the practical priority.

Stored cross-site scripting in the affiliate-toolkit - Multi-Network Affiliate & Amazon Product Display WordPress plugin, affecting all versions through 3.9.2, allows script to be persisted through the 'atkp_product_producturl' product-URL field because the value is insufficiently sanitized on input and not escaped on output, so it executes in the browser of any user who later opens the injected product page. In a default installation the practical bar is contributor-level access or above, matching the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N; the unauthenticated path described in the original 7.2 rating only opens up when the plugin's AJAX loading or AJAX handler option is enabled and the attacker knows a valid product id to render, making it a non-default configuration. Impact is confined to browser-context script execution with limited confidentiality and integrity effect and no availability impact, and no public exploit code, PoC reference, or CISA KEV entry was identified at time of analysis.