Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · ar-for-wordpress
AR For
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 2, 2026AR for: Directory TraversalCVE-2026-14327 · affects up to 8.40 · reported by WordfenceHigh 7.5
The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires an attacker to first obtain a valid nonce and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_image nopriv AJAX handlers, and to reproduce the encryption key locally — both steps are fully achievable by an unauthenticated attacker on any default free or unlicensed installation where ar_licence_key is unset.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2025AR For: Cross-Site Request Forgery (CSRF)CVE-2025-60156 · affects up to 8.34 · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
Feb 25, 2025AR For: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26913 · affects up to 7.7 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a through <= 7.7.
Dec 12, 2024AR for: Unauthorized double extension file uploadCVE-2024-12300 · affects up to 7.3 · reported by WordfenceLow 3.7
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2024AR For: Unrestricted Upload of File with Dangerous TypeCVE-2024-50496 · affects up to 6.6 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.