Ar For Wordpress Vulnerabilities

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation...

CVSS:

7.5

Affected:

up to 8.40

Fixed in:

8.41

Disclosed:

Jul 2, 2026

CVE-2026-14327 on NVD →

The AR For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.44. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can t...

CVSS:

4.3

Affected:

up to 8.44

Fixed in:

8.45

Disclosed:

Sep 26, 2025

CVE-2025-60156 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress allows DOM-Based XSS. This issue affects AR For WordPress: from n/a through 7.7.

Affected:

up to 7.8

Fixed in:

7.8

Disclosed:

Feb 25, 2025

CVE-2025-26913 on NVD →

The AR For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...

CVSS:

6.4

Affected:

up to 7.7

Fixed in:

7.8

Disclosed:

Feb 23, 2025

CVE-2025-26913 on NVD →

[en] The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double exte...

Affected:

up to 7.4

Fixed in:

7.4

Disclosed:

Dec 13, 2024

CVE-2024-12300 on NVD →

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension...

CVSS:

3.7

Affected:

up to 7.3

Fixed in:

7.4

Disclosed:

Dec 12, 2024

CVE-2024-12300 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in Web and Print Design AR For WordPress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through 6.2.

Affected:

up to 7.0

Fixed in:

7.0

Disclosed:

Oct 28, 2024

CVE-2024-50496 on NVD →

The AR For WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS:

9.8

Affected:

up to 6.6

Fixed in:

7.0

Disclosed:

Oct 25, 2024

CVE-2024-50496 on NVD →

Affected:

up to 8.0

Fix:

No patched version reported

CVE-2025-60156 on NVD →