Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: wpWax Component: Post Grid, Slider & Carousel Ultimate Clear all filters
TI-2025-18499 CVE-2025-24782 · GHSA-cmcq-wxqx-v9r5

WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block &…

Priority LOW 39

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclu…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00474 Published 2025-01-27 No fix listed CWE-98
TI-2024-12451 CVE-2024-13409 · GHSA-5w95-4984-vhv6

Path traversal in wpWax Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg…

Priority MEDIUM 42

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' param…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00882 Published 2025-01-24 No fix listed CWE-22
TI-2024-19692 CVE-2024-29925 · GHSA-7qh2-q67g-xhj2

WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows Stored XSS.This issue affects Post Grid, Slider & Carousel Ultimate…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00336 Published 2024-03-27 No fix listed CWE-79
TI-2024-01866 CVE-2024-2006 · GHSA-hhhv-vcm4-mp23

Deserialization of untrusted data in wpWax Post Grid, Slider & Carousel Ultimate – with…

Priority MEDIUM 48

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01211 Published 2024-03-13 No fix listed CWE-502
TI-2022-01151 CVE-2022-1266 · GHSA-6hhv-7x2g-ggm9

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

Priority LOW 23

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilter…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00588 Published 2022-06-20 Fixed in 1.5.0 CWE-79