CVE-2025-10249
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Slider Revolution plugin for WordPress in versions up to and including 6.7.37 is vulnerable to unauthorized access and modification due to missing capability checks on several functions. Authenticated attackers with Contributor-level access or higher can install and activate add-ons, create sliders, and download arbitrary files.
Risk Assessment
A low-privileged attacker could install malicious add-ons, create unauthorized content, or download sensitive files, potentially leading to further escalation. This may harm the site's integrity and confidentiality.
Recommendation
Update the Slider Revolution plugin to a version later than 6.7.37. Additionally, review user permissions and remove unnecessary Contributor accounts.
Other vulnerabilities in Slider Revolution
See all- CVE-2026-57678High
The Slider Revolution plugin versions 7.0.0 through 7.0.16 contain a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script into an HTTP request that will be executed in the victim's browser.
- CVE-2026-7542Medium
The Slider Revolution plugin for WordPress versions 7.0 to 7.0.10 allows sensitive information disclosure. Authenticated attackers with Subscriber-level access can read server files (e.g., .sql, .log, .json) by copying them to a publicly accessible directory.
- CVE-2026-9050Medium
The Slider Revolution plugin for WordPress versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized data modification. Lack of permission verification allows authenticated attackers with Contributor-level access or higher to deactivate any active plugin on the site.
- CVE-2026-9048Medium
The Slider Revolution plugin for WordPress versions 7.0.0 – 7.0.14 exposes sensitive data via the 'slider.get.full' AJAX action. Authenticated attackers with Contributor-level access or higher can extract raw social media API credentials, including Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID.
- CVE-2026-6728Medium
The Slider Revolution plugin for WordPress up to version 7.0.9 has a sensitive information exposure vulnerability via the 'get_stream_data()' function. Unauthenticated attackers can extract data including password-protected post, page, and product content.
- CVE-2025-9217Medium
The Slider Revolution plugin for WordPress in versions up to and including 6.7.36 is vulnerable to path traversal via the 'used_svg' and 'used_images' parameters. An authenticated attacker with Contributor-level access or higher can read arbitrary files on the server, which may contain sensitive information.
Original NVD description (English source)
The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS