CVE-2026-66635

WordPress Slider by 10Web plugin (versions ≤ 1.2.62) contains a CSRF vulnerability allowing an unauthenticated attacker to trick an authenticated user into deleting arbitrary files on the server. The flaw stems from missing CSRF protection on file-deletion actions. Impact is availability-focused ...

CVE-2026-66635 WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66635

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

EUVD-2026-60915

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66622

The WordPress Depicter Slider plugin (versions ≤ 4.8.0) has an unauthenticated SQL injection vulnerability exploitable over the network, rated HIGH (CVSS 7.5), allowing database disclosure; no in-the-wild exploitation or patch details are provided in the documents. Patchstack's advisory is linked...

WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peng Zhou in WordPress Plugin Depicter Slider versions = 4.8.0...

WordPress Slider Hero with Video Background, Animation plugin <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability

Authenticated Administrator+ SQL Injection via 'description' Slide Field Second-Order via Duplicate vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Slider Hero versions = 9.1.7...

WordPress Serious Slider plugin <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'theme' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Serious Slider versions = 1.4.0...

WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

CSRF to Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.62...

CVE-2026-66635: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

PT-2026-77063

Name of the Vulnerable Software and Affected Versions Slider by 10Web versions prior to 1.2.63 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to force an authenticated user to execute unwanted actions on the web application. Recommendations...

PT-2026-77058

Name of the Vulnerable Software and Affected Versions Depicter Slider versions prior to 4.8.1 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...

CVE-2026-66622: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-17582

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582 Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...

CVE-2026-17582

Vulnerability details (CVE-2026-17582): The Slider Hero plugin for WordPress is affected up to version 9.1.7 by a second‑order SQL Injection in the qcld_sliderhero_duplicate() function. While slides are safely stored via prepared placeholders in qchero_save_image, triggering the 'heroduplicatesli...

EUVD-2026-59902

The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcldsliderheroduplicate function. Slide data description, title, btn, btn2, imagelink, custom, etc. is stored safely via $wpdb-update with %s placeholders in the...