UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-6528

Slider Revolution: Code Injection

Severity
High 8.8
Published
30 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.6.19
Also known as
WPV-2fbcbd46d204
Sources
NVD, WPVulnerability

Description

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.

Affected software

SoftwareAffected versions
Slider RevolutionServers and applications · cpe:a:themepunch:slider_revolution
  • Every version before 6.6.19
Slider RevolutionWordPress plugins · wp-plugin:revslider
  • Every version before 6.6.19

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-6528
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-6528
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/revslider/slider-revolution-6619-authenticated-author-php-object-injection