4665 matches found
WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...
WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
Slider Future WordPress plugin = 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'sliderfuturehandleimageupload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication. id: CVE-2026-1405 info: name: WordPres...
OWL Carousel Slider - Cross-Site Scripting
OWL Carousel Slider WordPress plugin v2.2 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft malicious URL. id: CVE-2024-13627 info:...
WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection
WordPress WP TripAdvisor Review Slider plugin before 10.8 is susceptible to authenticated SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. This can lead...
SlideDeck 1 Lite Content Slider - Cross-Site Scripting
SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...
CVE-2026-76789
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
EUVD-2026-64223
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
CVE-2026-76789
CVE-2026-76789 is an unauthenticated stored XSS in the Slider Hero with Video Background, Animation WordPress plugin (versions before 9.1.3 ). Two request handlers — the Slider Type Change and Add-Slider handlers — lack proper authorisation and nonce checks , and a stored setting is not escaped b...
CVE-2026-76789 Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...
WordPress Slick Slider plugin < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode vulnerability
Contributor+ Stored XSS via Gallery Shortcode vulnerability discovered by testoun in WordPress Plugin Slick Slider versions 0.5.3...
CVE-2026-66635
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
EUVD-2026-60920
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
CVE-2026-66635
WordPress Slider by 10Web plugin (versions ≤ 1.2.62) contains a CSRF vulnerability allowing an unauthenticated attacker to trick an authenticated user into deleting arbitrary files on the server. The flaw stems from missing CSRF protection on file-deletion actions. Impact is availability-focused ...
CVE-2026-66635 WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
CVE-2026-66635
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
EUVD-2026-60915
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...