The affiliate‑toolkit plugin for WordPress is susceptible to stored cross‑site scripting through the atkp_product_producturl parameter. Input to this field is neither sanitized nor properly escaped, permitting an attacker to embed arbitrary JavaScript. When the affected product page is later viewed, the malicious script is executed in the victim’s browser, giving the attacker the ability to deface content, hijack sessions, or redirect users. This flaw is a classic XSS weakness (CWE‑79).

The vulnerability affects all installations of the affiliate‑toolkit – Multi‑Network Affiliate & Amazon Product Display plugin with versions up to and including 3.9.2. The plugin operates within WordPress sites and is delivered by the vendor cservit.

The severity of the issue is reflected in a CVSS score of 7.2. While the EPSS score is not available, the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by targeting sites that have the plugin’s AJAX loading or AJAX handler option enabled, or by leveraging contributor‑level or higher access if the default configuration is not altered. The risk is therefore moderate to high for sites that expose these options to the public or have users with sufficient privileges.