CVE-2025-39480

Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through 1.6.8...

CVE-2025-39480

CVE-2025-39480 describes a Deserialization of Untrusted Data vulnerability (PHP Object Injection) in ThemeMakers Car Dealer (WordPress theme) affected versions through 1.6.6. The issue enables object injection on unauthenticated access, with attacker‑controlled data potentially compromising confi...

WordPress Car Dealer theme <= 1.6.6 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Bonds in WordPress Theme Car Dealer versions = 1.6.6...

CVE-2017-1000465

Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of service and execution of javascript code...

CVE-2021-4343

The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stmlistingregister AJAX action function being accessible and taking roles unprotected. This makes it possible for unauthenticated...

CVE-2021-4346

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stmlistingprofileedit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog,...

WordPress Barcode Scanner and Inventory manager plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ngô Thái An Patchstack Alliance in WordPress Plugin Barcode Scanner with Inventory & Order Manager versions = 1.6.6...

WordPress plugin Accounting for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2024-16910 · WordPress · Accounting For Woocommerce

Name of the Vulnerable Software and Affected Versions: Accounting for WooCommerce plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

WordPress Accounting for WooCommerce plugin <= 1.6.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Accounting for WooCommerce versions = 1.6.6...

WordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin WeChat Subscribers Lite versions = 1.6.6...

WordPress KB Support plugin <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions vulnerability

Missing Authorization to Authenticated Subscriber+ Multiple Administrator Actions vulnerability discovered by Krzysztof Zając in WordPress Plugin KB Support versions = 1.6.6...

PT-2024-39087 · WordPress · The Kb Support – Wordpress Help Desk/Knowledge Base

Name of the Vulnerable Software and Affected Versions: The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to a missing capability check on several functions, allowing authenticated attackers with...

WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin <= 1.6.6 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Docket WooCommerce Collections / Wishlist / Watchlist versions 1.7.0...

CVE-2024-5004

The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

PT-2024-33880 · WordPress · Cm Popup Plugin

Name of the Vulnerable Software and Affected Versions: CM Popup Plugin for WordPress versions prior to 1.6.6 Description: The issue concerns the lack of sanitization and escaping of certain campaign settings, potentially allowing high-privilege users, such as contributors, to perform Stored...

WordPress plugin Font Farsi 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

PT-2024-23148 · WordPress · Wpwax Post Grid

Name of the Vulnerable Software and Affected Versions: wpWax Post Grid, Slider & Carousel Ultimate versions 1.6.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means...

PrestaShop Path Traversal Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A path traversal vulnerability exists in PrestaShop lgsitemaps versions prior to 1.6.6. An attacker could...

Cross-site Scripting potential in custom links, job buttons, and computed fields

Impact All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected. Due to incorrect usage of Django's marksafe API when rendering certain types of user-authored content, including: - custom links - job buttons - computed fields it is possible that users with permission to...