CVE-2026-111314

{
  "etk_id": "ETK-2026-2827",
  "cve_id": "CVE-2026-111314",
  "display_id": "CVE-2026-111314",
  "ghsa_id": "GHSA-37cc-r8jg-x2q6",
  "euvd_id": "EUVD-2026-111563",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in affiliate-toolkit",
  "summary": "affiliate-toolkit versions through 3.9.2 can store attacker-supplied script content that runs when affected pages are viewed. Unauthenticated attackers require AJAX loading or AJAX handling to be enabled and knowledge of a product identifier; with those options disabled, contributor-level access is required.",
  "mitigation": "Disable the plugin's AJAX loading and AJAX handler options, and restrict contributor access to trusted users. Remove or disable the plugin where those options are required, and update when the vendor publishes a fixed release.",
  "vendor": "cservit",
  "product": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.9.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.010435433333333334,
  "t0_at": "2026-10-28T02:29:59.059000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T03:04:22.283113+00:00",
      "days": 0.023879908715277776,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T02:29:59.059000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T02:29:59.059000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T02:29:59.059000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111314"
    }
  }
}