Vulnerabilities

TI-2026-12135 CVE-2026-14352 · GHSA-r26p-86pc-qqj4

AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter

MEDIUM 40

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00675 Published 2026-07-03 No fix listed CWE-22

TI-2026-12117 CVE-2026-14327 · GHSA-c67p-rxvq-wp57

AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter

MEDIUM 40

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00615 Published 2026-07-03 No fix listed CWE-22

TI-2023-30624 CVE-2023-54350 · GHSA-2qg7-25w5-v2qc

WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated

HIGH 77

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00532 Published 2026-06-08 No fix listed CWE-306

TI-2025-37522 CVE-2025-60156 · GHSA-hxqp-vwmr-h574

WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability

MEDIUM 42

Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0017 Published 2025-09-26 No fix listed CWE-352

TI-2025-19784 CVE-2025-26913 · GHSA-qpfp-5mrm-frcc

WordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a throu…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0028 Published 2025-02-25 No fix listed CWE-79

TI-2024-11410 CVE-2024-12300 · GHSA-697v-r35h-ff64

AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload

LOW 18

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00392 Published 2024-12-13 No fix listed CWE-862

TI-2024-33939 CVE-2024-50510 · GHSA-3m4m-9gjr-cqwf

WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

MEDIUM 51

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0102 Published 2024-10-30 No fix listed CWE-434

TI-2024-33927 CVE-2024-50496 · GHSA-rmmp-g38r-57jx

WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability

MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00511 Published 2024-10-28 No fix listed CWE-434

Vulnerabilities

Filters