CVE-2024-13408: Improper Control of Filename for Include/Require Statement in PHP Program

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the pgcu shortcode. This makes it possible for authenticated attacker...

CVE-2025-22553

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL Injection.This issue affects Multiple Carousel: from n/a through = 2.0...

CVE-2025-22553

CVE-2025-22553 is a SQL Injection vulnerability affecting the WordPress plugin Multiple Carousel (versions up to 2.0). The issue stems from improper neutralization of specific elements in SQL commands, enabling unauthenticated attackers to potentially manipulate database queries. Public documents...

CVE-2025-22553 WordPress Multiple Carousel Plugin <= 2.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NotFound Multiple Carousel allows SQL Injection. This issue affects Multiple Carousel: from n/a through 2.0...

Malicious code in design-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a127fa5f9bae939a2e9a5c9f4dd17b801b5dad70a7299913ac5245397aeb519e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-290 Malicious code in design-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a127fa5f9bae939a2e9a5c9f4dd17b801b5dad70a7299913ac5245397aeb519e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-4544

Name of the Vulnerable Software and Affected Versions NotFound Multiple Carousel versions n/a through 2.0 Description The issue is related to improper neutralization of special elements used in SQL commands, allowing SQL Injection attacks. This enables attackers to inject malicious SQL code,...

WordPress plugin Multiple Carousel SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability...

CVE-2025-22553: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL Injection.This issue affects Multiple Carousel: from n/a through = 2.0...

CVE-2025-23933

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpfreeware WpF Ultimate Carousel wpf-ultimate-carousel allows Stored XSS.This issue affects WpF Ultimate Carousel: from n/a through = 1.0.11...

CVE-2025-23933 WordPress WpF Ultimate Carousel plugin <= 1.0.11 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpfreeware WpF Ultimate Carousel wpf-ultimate-carousel allows Stored XSS.This issue affects WpF Ultimate Carousel: from n/a through = 1.0.11...

CVE-2025-23933

CVE-2025-23933 affects WpF Ultimate Carousel (WpFreeware) up to version 1.0.11 with Stored XSS due to improper input neutralization during web page generation. Public sources (Red Hat and Wordfence) confirm this vulnerability exists and is currently Unpatched; no exploitation details are provided...

CVE-2025-23933 WordPress WpF Ultimate Carousel plugin <= 1.0.11 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpfreeware WpF Ultimate Carousel wpf-ultimate-carousel allows Stored XSS.This issue affects WpF Ultimate Carousel: from n/a through = 1.0.11...

WordPress WpF Ultimate Carousel plugin <= 1.0.11 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin WpF Ultimate Carousel versions = 1.0.11...

PT-2025-5212

Name of the Vulnerable Software and Affected Versions WpF Ultimate Carousel versions 1.0.11 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicio...

WordPress plugin WpF Ultimate Carousel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-23933: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpfreeware WpF Ultimate Carousel wpf-ultimate-carousel allows Stored XSS.This issue affects WpF Ultimate Carousel: from n/a through = 1.0.11...

CVE-2025-22750

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Patel Post Carousel & Slider post-types-carousel-slider allows Reflected XSS.This issue affects Post Carousel & Slider: from n/a through = 1.0.4...

CVE-2025-22724

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MojofyWP Product Carousel For WooCommerce – WoorouSell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through 1.1.0...

PT-2025-4651 · Woorousell · Mojofywp Product Carousel For Woocommerce

Name of the Vulnerable Software and Affected Versions: MojofyWP Product Carousel For WooCommerce – WoorouSell versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS...