Servit Affiliate Toolkit vulnerabilities
7 vulnerabilities
Known vulnerabilities in Servit Affiliate Toolkit, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-46231servit software solutionsaffiliate-toolkit+2
EPSS score0.17%
Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3.CVE-2024-2298cservitaffiliate-toolkit – multi-network affiliate & amazon product display+2EPSS score0.32%
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing products.CVE-2024-1851cservitaffiliate-toolkit – multi-network affiliate & amazon product display+2EPSS score0.29%
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists.CVE-2023-46086servit software solutionsaffiliate-toolkit – wordpress affiliate plugin+2EPSS score0.41%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin allows Reflected XSS.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.4.3.CVE-2023-5877servitaffiliate-toolkit+2EPSS score0.90%
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.CVE-2023-45105servit software solutionsaffiliate-toolkit – wordpress affiliate plugin+2EPSS score0.48%
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.3.9.CVE-2023-23786christof servitaffiliate-toolkit+2EPSS score0.36%
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Christof Servit affiliate-toolkit plugin <= 3.3.3 versions.