Depicter — Popup & Slider Builder
Depicter — Popup & Slider Builder (depicter-popup-slider-builder) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 23, 2026; the highest published CVSS base score is 7.2.
depicter-popup-slider-builderCVE-2026-113472: Depicter — Popup & Slider Builder: Dangerous editor media uploads
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 4.0.5 to before 4.8.2.
| Safe version |
|
||
|---|---|---|---|
| Oct 23, 2026 |
CVE-2026-113472
Depicter — Popup & Slider Builder: Dangerous editor media uploads
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 4.0.5 to before 4.8.2.
|
4.8.2 |
CVE5.4
|
| Aug 20, 2026 |
CVE-2026-15049
Depicter imports permit Editor arbitrary-file upload
Depicter before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload. An Editor can use that import path to write an arbitrary file, including executable PHP, into a web-accessible directory. Where the server executes PHP in that directory, requesting the uploaded file produces remote code execution.
|
4.8.0 |
CVE7.2
|