reality66 vulnerabilities

Products

• cart66 lite 3
• Cart66 Cloud :: WordPress Ecommerce The Easy Way 1

Latest reality66 CVEs

Newest publication first

1. CVE-2025-2841 Cart66 Cloud <= 2.3.7 - Unauthenticated Information Exposure

   Published 2025-04-12

   Medium·CVSS 5.3 EPSS 0.42%

   The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information con...

2. CVE-2014-9461 Cart66 Lite - WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure

   Published 2015-01-02

   Low·CVSS 3.5 EPSS 2.1%

   Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the member_download action to wp-admin/admin-ajax.php.

3. CVE-2014-9442 Cart66 Lite :: WordPress Ecommerce <= 1.5.3 - SQL Injection

   Published 2015-01-02

   Medium·CVSS 6.5 EPSS 1.8%

   SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.

4. CVE-2014-9305 Cart66 Lite :: WordPress Ecommerce < 1.5.2 - SQL Injection

   Published 2014-12-08

   Medium·CVSS 6.5 EPSS 3.6% Public exploit

   SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-adm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.