CVE-2026-113472

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

EUVD-2026-108598

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

PT-2026-121771

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

CVE-2026-15049: Unrestricted Upload of File with Dangerous Type

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

PT-2024-14971

Name of the Vulnerable Software and Affected Versions The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on...