174 matches found
CVE-2025-2011
CVE-2025-2011 - Depicter Plugin SQL Injection Vulnerability CVE Reference: CVE-2025-2011 This repository contains a proof-of-concept environment for testing the SQL injection vulnerability in Depicter Slider & Popup Builder plugin versions 3.6.2. Prerequisites Docker Docker Compose Python 3.x...
CVE-2025-2011-poc
WordPress Depicter Plugin 3.6.1 - SQL Injection usage: exploit.py -h -u URL -D DATABASE -T TABLE -C COLUMN...
WordPress Depicter — Popup & Slider Builder plugin 4.0.5-4.8.1 - Editor+ Arbitrary File Upload vulnerability
Editor+ Arbitrary File Upload vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Depicter Slider versions 4.0.5-4.8.1...
CVE-2026-113472
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...
EUVD-2026-108598
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...
CVE-2026-113472 Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...
CVE-2026-113472
The Depicter — Popup & Slider Builder WordPress plugin (versions 4.0.5-4.8.1 ) contains an arbitrary file upload vulnerability in the editor media-upload endpoint. The root cause is insufficient validation, as the plugin only checks the client-supplied MIME type and a case-sensitive block of the ...
PT-2026-121771
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...
WordPress Depicter plugin < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import vulnerability
Editor+ Arbitrary File Upload via ZIP Import vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin Depicter Slider versions 4.8.0...
CVE-2026-15049
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...
EUVD-2026-63202
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...
CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...
CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...
CVE-2026-15049
The Depicter — Popup & Slider Builder WordPress plugin (versions before 4.8.0 ) contains an arbitrary file upload vulnerability. The root cause is a failure to validate the type of files uploaded via the import feature and a failure to remove malformed uploads. This allows users with editor-level...
CVE-2026-15049: Unrestricted Upload of File with Dangerous Type
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...
PT-2026-78890
Name of the Vulnerable Software and Affected Versions Depicter — Popup & Slider Builder WordPress plugin versions prior to 4.8.0 Description Users with editor-level access can upload arbitrary files, including executable PHP scripts, into a web-accessible directory. This occurs because the import...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66622
The WordPress Depicter Slider plugin (versions ≤ 4.8.0) has an unauthenticated SQL injection vulnerability exploitable over the network, rated HIGH (CVSS 7.5), allowing database disclosure; no in-the-wild exploitation or patch details are provided in the documents. Patchstack's advisory is linked...