affiliate-toolkit vulnerabilities
CVEs whose affected-version data names the affiliate-toolkit package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110179Medium· 6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capab…
▾ SunlitEPSS 0.17%via CVEORG
CVE-2026-86787High· 7.2The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above…
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above…
▾ Twilightvia NVD