The affiliate‑toolkit plugin contains a stored cross‑site scripting vulnerability (CWE‑79) in the atkp_product shortcode. User supplied attributes are stored without sanitization and later rendered unescaped in product listings. An authenticated user with contributor‑level permissions can embed arbitrary JavaScript, which is executed whenever anyone views the affected page. The vulnerability permits malicious code execution in the browser context of site visitors, potentially allowing tampering with page content or user interactions. The description does not mention specific post‑exploitation objectives beyond script execution.

All WordPress installations that have cservit’s affiliate‑toolkit – Multi‑Network Affiliate & Amazon Product Display plugin version 3.7.0 or older and that use the atkp_product shortcode are vulnerable. The issue applies to any site granting contributor permissions or higher to users who can edit content containing the shortcode.

The flaw is exploitable only by users who possess contributor‑level or higher roles, as the attack requires creating or modifying shortcode attributes. Once an attacker injects malicious code, it is stored in the database and later served to all visitors. The CVSS score of 6.4 indicates moderate severity, while the EPSS score of <1% suggests a very low likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. The primary attack vector is authenticated access to the plugin’s content editing interface, followed by a user‑initiated request to the page that includes the shortcode.