CVE-2023-6528

Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.

Affected

Slider Revolution

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.37% chance of exploitation in the next 30 days, 72nd percentile

Published

2024-01-08

Updated

2025-06-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/36ced447-84ea-4162-80d2-6df226cb53cb

References

• CVE Record
• NVD entry