Stored Cross-Site Scripting in Multi-Network Affiliate & Amazon Product Display Plugin for WordPress

CVE-2026-111314

What is CVE-2026-111314?

The Multi-Network Affiliate & Amazon Product Display plugin for WordPress suffers from a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the 'atkp_product_producturl' parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 3.9.2. Unauthenticated attackers may inject arbitrary web scripts, leading to execution when a user accesses the compromised page. The exploitation is facilitated if the plugin's AJAX loading feature is enabled, which can allow harmful scripts to be executed in the context of the user's session. In default settings where AJAX is not configured, attackers require contributor-level access or higher to take advantage of this vulnerability.

References