Ar For Wordpress
Approved changes feed: RSS · Atom
cpe:2.3:a:webandprint:ar_for_wordpress:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Webandprint (e7588a35-ed57-59ef-85ad-b19615320926) |
|---|---|
| Product | Ar For Wordpress (25647ae2-db6c-5fa7-9653-213bc06e33ca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14327 |
vulnerable | 2026-07-29 00:26:16.927600 |
AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter
HIGH (7.5)
The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires an attacker to first obtain a valid nonce and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_image nopriv AJAX handlers, and to reproduce the encryption key locally — both steps are fully achievable by an unauthenticated attacker on any default free or unlicensed installation where ar_licence_key is unset.
Published: 2026-07-03T01:28:21.367Z
Updated: 2026-07-06T14:46:37.194Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-60156 |
vulnerable | 2026-06-08 07:37:26.700010 |
WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability
CRITICAL (9.6)
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
Published: 2025-09-26T08:31:56.219Z
Updated: 2026-04-28T16:13:55.863Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26913 |
vulnerable | 2026-06-08 07:14:50.663303 |
WordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a through <= 7.7.
Published: 2025-02-25T14:17:53.971Z
Updated: 2026-04-28T16:11:43.894Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-50496 |
vulnerable | 2026-06-08 06:52:10.257959 |
WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability
CRITICAL (10)
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.
Published: 2024-10-28T20:54:40.508Z
Updated: 2026-05-11T21:19:10.464Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12300 |
vulnerable | 2026-06-08 06:23:51.688527 |
AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload
LOW (3.7)
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.
Published: 2024-12-13T03:24:35.103Z
Updated: 2026-04-08T17:05:49.430Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.