WordPress Plugin TheCartPress eCommerce Shopping Cart is prone to multiple vulnerabilities, including cross-site scripting, cross-site request forgery, local file inclusion and security bypass vulnerabilities. Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, allowing the attacker to steal cookie-based authentication credentials and launch other attacks, to gain unauthorized access to the affected application, to obtain sensitive information or to perform otherwise restricted actions and subsequently browse orders of other users or steal all currently-existing orders. WordPress Plugin TheCartPress eCommerce Shopping Cart version 1.3.9 is vulnerable; prior versions may also be affected.
Update to plugin version 220.127.116.11 or latest
WordPress Plugin PhotoSmash Galleries Arbitrary File Upload (1.0.7)
WordPress Plugin WP Mega Menu Security Bypass (1.4.0)
WordPress Plugin WordPress renaming tool by Vlajo Arbitrary File Download (1.0)
WordPress Plugin Ecommerce-Two Factor Authentication Cross-Site Scripting (1.0.4)
WordPress Plugin Wordspew 'id' Parameter SQL Injection (1.16)