Wip Woocarousel Lite Vulnerabilities

The WIP WooCarousel Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged...

CVSS:

6.1

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Mar 26, 2025

CVE-2025-30769 on NVD →

The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...

CVSS:

6.4

Affected:

up to 1.1.6

Fixed in:

1.1.7

Disclosed:

Dec 4, 2024

CVE-2024-11779 on NVD →