https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2014-9461.htmlhttps://patchthecve.com/cve/CVE-2014-9461.htmlWed, 17 Jun 2026 00:18:25 +0000LOW 3.5: Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the member_download action to wp-admin/admin-ajax.php.https://patchthecve.com/cve/CVE-2014-9442.htmlhttps://patchthecve.com/cve/CVE-2014-9442.htmlWed, 17 Jun 2026 00:18:22 +0000MEDIUM 6.5: SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.https://patchthecve.com/cve/CVE-2014-9305.htmlhttps://patchthecve.com/cve/CVE-2014-9305.htmlWed, 17 Jun 2026 00:18:04 +0000MEDIUM 6.5: SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to wp-admin/admin-ajax.php.