Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

affiliate-toolkit · Version history

affiliate-toolkit changelog and version history

Latest version
3.9.3
Oct 22, 2026 (18 days ago)
Releases
31
since 2016
In the last year
8
about one every 49 days
Tested up to
WordPress 7.0.8
PHP 8.2 or later

Releases each year

  • 20164 releases
  • 20172 releases
  • 20194 releases
  • 20209 releases
  • 20242 releases
  • 20253 releases
  • 20267 releases

20267 releases

  1. affiliate-toolkit 3.9.3Latest

    • SECURITY: Fixed a stored Cross-Site Scripting (XSS) that low-privileged users (Contributor and above) could use to run JavaScript in an administrator’s browser, reported by the Wordfence Threat Intelligence team. The product link fields were stored and printed without any escaping: the “url” cast i…
    • SECURITY: Fixed an arbitrary file upload leading to Remote Code Execution by low-privileged users (Contributor and above), reported by the Wordfence Threat Intelligence team. The product image import took the file extension of the downloaded image from the url path and only replaced it when the ser…
    • SECURITY: Hardened the path that resolves a template name to a file (defence in depth, no exploit known). A template reference that is not a post id is resolved as a relative path below the template directories (“/.blade.php”), and the reference reaches that code from a shortcode as well as from th…
    • SECURITY: The “Templates” admin page was registered in the menu with the edit_pages capability, although the page itself has required manage_options since 3.9.1 – an editor saw the entry and ran into the error page. The menu entry now carries the same capability as the page.
    • SECURITY: The compatibility mode for old templates read the template fields of the given id without checking that the id really belongs to a template post, which is the pattern that was fixed for the Blade render paths in 3.9.1. The old templates are filled in by placeholder replacement and are not…
    • FIX: The “searchtemplate not found” error of the search form printed the requested template name unescaped (requires the “Frontend Search & Filter” extension 1.0.11, and only applies when “hide error messages” is off).

  2. affiliate-toolkit 3.9.2

    • SECURITY: Hardened the image proxy. The key that signs the proxy addresses was built from a short letter and number pattern and, whenever the key file could not be written, fell back to a value derived from the plugin path – and it was stored as a .php file below wp-content/uploads, which servers t…
    • FIX: Backslashes were lost in every field saved by the plugin, which made custom templates fail with errors like “Unclosed ‘(‘ does not match ‘]'” as soon as they were saved again. Post meta has to be handed to WordPress slashed because add_post_meta() unslashes it itself, but since the coding stan…
    • PERFORMANCE: The shop overview took up to half a minute to load. The “Imported Product count” column ran one query per shop row, and the product table had no index on shop_id, so every one of those queries was a full table scan. The counts for all shops are now collected in a single grouped query p…
    • FIX: The discount notice fetched its data from affiliate-toolkit.com on every single admin page, before even checking whether the notice may appear on that screen. With a cold cache this blocked the page load, and because a failed request was never cached, every following page tried again and ran i…
    • FIX: The delete button of a search key in the product editor was invisible. The button was rendered as an empty element and only ever got its trash icon from a stylesheet that is not loaded on the post editor screen, so the row could only be removed by guessing where to click. It now carries a dash…
    • SECURITY: Fixed an authenticated (administrator) SQL injection in the “Duplicate” action of the template list (CVE-2026-42721, reported by Ananda Dhakal via Patchstack). Duplicating a template copied the custom fields of the source post with one hand-built INSERT … UNION ALL SELECT statement, in wh…
    • SECURITY: Fixed an information disclosure in the AJAX render endpoint. The endpoint takes the product and list ids to render straight from the request and is reachable without a login whenever AJAX loading or the AJAX handler is enabled, but it only checked the post status of products that came fro…

  3. affiliate-toolkit 3.9.1

    • SECURITY: Fixed Remote Code Execution by low-privileged users (Contributor and above) — reported by Artus KG via WPScan. This is a complete fix for the incomplete patch of CVE-2026-6169. Template bodies are compiled and executed by the BladeOne engine, but the template renderer accepted any post id…
    • SECURITY: Hardened the template sanitizer as defence in depth. In addition to literal PHP tags it now also strips the Blade directives that exist purely to emit raw PHP (@php, @php … @endphp) or to instantiate an arbitrary class (@inject). Note that the sanitizer alone can never make an untrusted t…
    • SECURITY: The template sanitizer is now also applied on the live search template path and on @include/@extends targets, which previously bypassed it entirely.
    • PERFORMANCE: Added a missing index on wp_atkp_queues_entries (post_id, id). The “Queue History” metabox in the product, list and shop editor reads the most recent queue entries for the edited post, but the table only had indexes on queue_id. On large installations MySQL had to scan the whole table…
    • FIX: Queue table index creation is now idempotent. On a table structure version bump the existing CREATE INDEX statements were executed again and failed with MySQL error 1061 (“Duplicate key name”). Indexes are now only created when they do not exist yet, and a manually created index on post_id is…
    • FIX: A PHP Error (e.g. TypeError) inside a shop provider no longer stops the cronjob permanently. The queue processing only caught Exception, so a PHP Error escaped both the inner and the outer handler and killed the run before the entry statuses were written. The same batch of 10 entries was then…
    • FIX: Endless loop in the queue processing when an atkp_queue_process_entries_* filter returns only part of the entries it was given. The dropped entries kept the status “prepared” and were delivered again by get_next_entries on every iteration. They are now marked as not processed, like entries the…
    • FIX: The “Delete” row action in the queue and template lists always failed with “Go get a life script kiddies”. The link was created with the nonce action atkp_edit_queue/atkp_edit_template but verified against atkp_delete_link.
    • IMPROVED: The active queue is now selected deterministically (oldest first) instead of relying on the storage order of the table.
    • NEW: Stalled queues are detected and aborted. A queue that makes no progress across several cron runs — because the same package always dies on a fatal error, a timeout or out of memory — used to stay “active” forever, which blocked every new queue and stopped the cleanup of old queues. The number…
    • IMPROVED: Old queues are now cleaned up on every cron run instead of only after a queue has completed, so a single stalled queue can no longer stop the cleanup permanently. Active queues are excluded from the cleanup so the queue currently being processed is never deleted.
    • PERFORMANCE: Added an index on wp_atkp_queues_entries (queue_id, updatedon). The cronjob reads the last entry activity of the running queue on every run, which previously sorted all entries of that queue (on large installations hundreds of thousands of rows) instead of doing an index lookup.
    • IMPROVED: The “Retries” column of the queue list now shows the number of cron runs without progress. The counter is reset as soon as the queue advances, so it no longer grows with the plain number of runs.
    • FIX: The disclaimer with the “Last updated on …” line was missing in all templates — most visibly in the WooCommerce price comparison tab, where it is the only place the update time is shown. The option cache introduced in 3.8 carries its own table of fallback values, and because that table pre-see…
    • FIX: A default value passed by the caller now takes precedence over the option cache’s fallback table whenever the option has never been saved, which is how get_option() behaved before the cache was introduced. This also corrected the fallbacks for add_to_cart and boxcontent, which contradicted the…
    • FIX: Undefined variable $hidedisclaimer in the AJAX render path. The disclaimer is now controlled by the template parameters there as well, so the hidedisclaimer attribute of the shortcode and a template-specific disclaimer text are honored on the AJAX path too.
    • FIX: The “disable disclaimer” flag of a template (used by compatibility templates) was only honored on the AJAX render path and ignored everywhere else. It is now evaluated once in atkp_template_parameters::buildTemplateArray(), so it applies on every output path — including the @if($parameters->ge…
    • FIX: Two disclaimers were rendered inside one product box when a template that carries a disclaimer block (for example “Price comparison (simple)”, “Price comparison” or a custom template) was selected as the template for the additional offers. The dropdown for that sub-template is filled from the…
    • FIX: Product images were not imported from shops whose CDN rejects requests that do not look like a browser (403 Forbidden). The image download built a stream context with a User-Agent header but then never passed it to file_get_contents(), so every image was requested without a User-Agent, an Acce…
    • FIX: The error logged for a failed image download came from error_get_last() and could therefore show a completely unrelated PHP notice instead of the actual reason. The HTTP status code or transport error of the image request is logged now.
    • FIX: An image url with a query string (for example image.jpg?ts=1790734482) lost its file extension, because the extension was taken with strrchr() from the whole url instead of its path, and the result was longer than three characters. Every such image was stored as .jpg – a .png or .gif therefore…
    • FIX: Images are no longer stored with a wrong extension when the shop CDN does content negotiation. Such a CDN answers a .jpg url with a WebP or AVIF body as soon as a browser-like Accept header is sent. The Accept header deliberately does not offer those formats, and if the answer still has a diff…
    • IMPROVED: An error page that a CDN returns with status 200 instead of an error code is no longer stored as a product image. The response has to be an image by content type or by content, otherwise the download counts as failed.

  4. affiliate-toolkit 3.9.0

    • FIX: Comparison table not rendered when tracking_id is set in shortcode (Creators API cart URLs use ?AssociateTag= instead of &AssociateTag= after removal of AWSAccessKeyId parameter)
    • FIX: Tracking code replacement errors no longer break entire template output (graceful fallback to original URL)
    • IMPROVED: Admin styles updated to use standard WordPress UI colors and buttons instead of custom branding
    • IMPROVED: Extensions page redesigned with installed/bundled status badges, version info, and cleaner layout

  5. affiliate-toolkit 3.8.9

    • SECURITY: Fixed SQL Injection vulnerability in admin list tables (orderby parameter) — reported via Wordfence. orderby and order parameters are now validated against a strict whitelist of allowed column names instead of relying on esc_sql(), which does not protect unquoted SQL identifiers.

  6. affiliate-toolkit 3.8.8

    • FIX: License check no longer invalidates active licenses when the API server is temporarily unreachable
    • FIX: License status comparison corrected from ‘active’ to ‘valid’ on the license settings page
    • FIX: Manual offers not displayed in the frontend due to wp_rand() returning positive shop IDs instead of negative
    • FIX: Template PHP sanitization now only applies to user-created templates (DB), not to built-in filesystem templates

  7. affiliate-toolkit 3.8.7

    • NEW: Admin notice informing about the PHP tag filtering security feature (with explicit confirmation)
    • NEW: Option to disable PHP tag filtering in templates (Advanced Settings, requires explicit opt-in)
    • IMPROVED: Extension loading moved from init to plugins_loaded for better compatibility
    • IMPROVED: Minimum PHP version raised to 8.2
    • FIX: ATKP_StoreController class existence check added to prevent fatal errors in discount notifications

20253 releases

  1. affiliate-toolkit 3.8.0

    • fix: add license validation for shops and products, enhance live search error handling

  2. affiliate-toolkit 3.7.9

    • fix: correct option name extraction in get_setting method
    • fix: issue with empty sub lists in shop

  3. affiliate-toolkit 3.7.7

    • fix: standardize spacing and formatting in various files Performance optimizations and code cleanups

20242 releases

  1. affiliate-toolkit 3.6.9

    • Fixed: shortcode was not processed

  2. affiliate-toolkit 3.6.8

    • Fixed: Language issue (wp 6.7 update)
    • Fixed: Security issue (thanks to Peter Thaleikis)

20209 releases

  1. affiliate-toolkit 2.7.5

  2. affiliate-toolkit 2.7.4.2

  3. affiliate-toolkit 2.7.4

  4. affiliate-toolkit 2.7.3.2

  5. affiliate-toolkit 2.7.3

  6. affiliate-toolkit 2.7.2

  7. affiliate-toolkit 2.7.1

  8. affiliate-toolkit 2.7

  9. affiliate-toolkit 2.6.6

20194 releases

  1. affiliate-toolkit 2.6.1

  2. affiliate-toolkit 2.6

  3. affiliate-toolkit 2.5.1

  4. affiliate-toolkit 2.5

20172 releases

  1. affiliate-toolkit 2.1

  2. affiliate-toolkit 2.0

20164 releases

  1. affiliate-toolkit 1.3

  2. affiliate-toolkit 1.2

  3. affiliate-toolkit 1.1

  4. affiliate-toolkit 1.0

Questions about affiliate-toolkit’s releases

What is the latest version of affiliate-toolkit?

3.9.3, released on Oct 22, 2026 (2 weeks ago). It’s tested up to WordPress 7.0.8 and needs PHP 8.2 or later.

How often is affiliate-toolkit updated?

8 releases in the last year, about one every 49 days. Its first release on WordPress.org dates from September 2016.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in affiliate-toolkit’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.