WordPress security by component
AliNext
Plugin description
AliNext is a WordPress component with 8 published CVE records in this archive. The latest tracked vulnerability was published Jun 17, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
ali2woo-liteLatest vulnerability
CVE-2024-37210: AliNext: A security weakness
AliNext is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.3.5. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
| Safe version |
|
||
|---|---|---|---|
| Jun 17, 2026 |
CVE-2024-37210
AliNext: A security weakness
AliNext is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.3.5. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
3.3.7 |
CVE6.5
NVDPending
|
| Mar 27, 2025 |
CVE-2025-30859
AliNext: An open redirect
AliNext is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.7
NVDPending
|
| Nov 01, 2024 |
CVE-2024-37214
Ali2Woo Lite: Cross-site scripting
Ali2Woo Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jul 22, 2024 |
CVE-2024-37211
Ali2Woo Lite: Cross-site scripting
Ali2Woo Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Jul 12, 2024 |
CVE-2024-37213
AliNext: Cross-site request forgery
AliNext is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.1
NVDPending
|
| Jun 21, 2024 |
CVE-2024-37212
Ali2Woo Lite: Cross-site request forgery
Ali2Woo Lite is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE8.3
NVD8.8
|
| Jun 19, 2024 |
CVE-2024-4450
AliExpress Dropshipping with AliNext Lite: A security weakness
AliExpress Dropshipping with AliNext Lite is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.3
NVDPending
|
| Jun 19, 2024 |
CVE-2024-2381
AliExpress Dropshipping with AliNext Lite: Dangerous file upload
AliExpress Dropshipping with AliNext Lite is affected by dangerous file upload. Exploitation requires an authenticated subscriber account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE8.8
NVDPending
|