GCVE - cpe:2.3:a:servit:affiliate-toolkit:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:servit:affiliate-toolkit:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Servit (`8086b7eb-7ac4-5afe-98c6-717b47b14c64`)
Product	Affiliate Toolkit (`3e9ca67b-ccb9-5a47-915d-6f87c3cfb5a3`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/wpplugins/affiliate-toolkit-starter`	purl2cpe	2026-06-01 10:11:26.413770

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-46231`	vulnerable	2026-06-08 07:25:11.347593	WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability MEDIUM (5.4) Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3. Published: 2025-04-22T09:53:22.691Z Updated: 2026-04-28T16:12:36.655Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/affiliate-toolkit-starter/vulnerability/wordpress-affiliate-toolkit-3-7-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6562`	vulnerable	2026-06-08 06:58:19.858797	affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure MEDIUM (5.3) The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This is due display_errors being set to true . This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. Published: 2024-08-09T09:30:14.100Z Updated: 2026-04-08T17:33:52.650Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/f810cc65-5a19-4ad7-a6b6-41a9b4f30f4c?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3148552%40affiliate-toolkit-starter&new=3148552%40affiliate-toolkit-starter&sfp_email=&sfph_mail= https://plugins.trac.wordpress.org/browser/affiliate-toolkit-starter/trunk/lib/apai-io/exeu/apai-io/samples/Search/SimpleSearch.php?rev=1502240	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37205`	vulnerable	2026-06-08 06:39:46.863269	WordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data Exposure via Log File vulnerability MEDIUM (5.3) Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4. Published: 2024-07-10T17:50:33.632Z Updated: 2026-04-28T16:09:56.653Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-plugin-3-4-4-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2298`	vulnerable	2026-06-08 06:33:30.792070	affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product MEDIUM (4.3) The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing products. Published: 2024-03-08T06:58:06.089Z Updated: 2026-04-08T16:51:25.255Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4d0176-3b7d-4de5-95ec-365873e6f13b?source=cve https://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1851`	vulnerable	2026-06-08 06:27:14.700542	affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list MEDIUM (6.3) The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists. Published: 2024-03-08T06:58:06.723Z Updated: 2026-04-08T17:30:54.390Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e256b0-e4e3-4f41-842c-80aa2b80af72?source=cve https://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-5877`	vulnerable	2026-06-08 06:19:45.011443	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-46086`	vulnerable	2026-06-08 06:12:43.821770	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45105`	vulnerable	2026-06-08 06:12:41.968787	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23786`	vulnerable	2026-06-08 05:56:04.414630	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.