Woo Product Carousel Slider And Grid Ultimate Vulnerabilities

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abo...

CVSS:

4.4

Affected:

up to 1.10.0

Fixed in:

1.10.1

Disclosed:

Jan 24, 2025

CVE-2025-24681 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce allows Stored XSS. This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through 1.10.0.

Affected:

up to 1.10.1

Fixed in:

1.10.1

Disclosed:

Jan 24, 2025

CVE-2025-24681 on NVD →

[en] The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to in...

Affected:

up to 1.10.0

Fixed in:

1.10.0

Disclosed:

Dec 12, 2024

CVE-2024-12040 on NVD →

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include...

CVSS:

8.8

Affected:

up to 1.9.10

Fixed in:

1.10.0

Disclosed:

Dec 11, 2024

CVE-2024-12040 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce allows PHP Local File Inclusion.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through 1.9.10.

Affected:

up to 1.10.0

Fixed in:

1.10.0

Disclosed:

Sep 23, 2024

CVE-2024-44048 on NVD →

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing...

CVSS:

8.8

Affected:

up to 1.9.10

Fixed in:

1.10.0

Disclosed:

Sep 16, 2024

CVE-2024-44048 on NVD →

[en] The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated attackers, with contributor access and above, to inject a...

Affected:

up to 1.9.8

Fixed in:

1.9.8

Disclosed:

Mar 13, 2024

CVE-2024-1950 on NVD →

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP...

CVSS:

7.5

Affected:

up to 1.9.7

Fixed in:

1.9.8

Disclosed:

Mar 5, 2024

CVE-2024-1950 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 1.9.3

Fixed in:

1.9.4

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 1.9.3

Fixed in:

1.9.4

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →

The WooCommerce Product Carousel, Slider & Grid Ultimate plugin for WordPress, versions up to and including 1.8.6, is vulnerable to Cross-Site Scripting. The script /includes/carousel.php (as well as other setting-related scripts) does not sanitize user input. This allows a lower-level user (contributor and higher) to...

CVSS:

6.4

Affected:

up to 1.8.6

Fixed in:

1.8.7

Disclosed:

Aug 5, 2022

The WooCommerce Product Carousel, Slider & Grid Ultimate plugin for WordPress, versions up to and including 1.8.6, is vulnerable to Cross-Site Scripting. The script /includes/carousel.php (as well as other setting-related scripts) does not sanitize user input. This allows a lower-level user (contributor and higher) to...

Affected:

up to 1.8.7

Fixed in:

1.8.7

Disclosed:

Aug 5, 2022

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 1.9.4

Fixed in:

1.9.4

CVE-2022-47150 on NVD →