CVE-2026-105885
HighCVSS 8.8Summary
Slider by 10Web through version 1.2.62 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.
Risk Assessment
The risk includes remote code execution, data integrity compromise, or application takeover, potentially leading to full system compromise.
Recommendation
Update Slider by 10Web to a patched version and avoid deserializing data from untrusted sources. Also, use secure deserialization mechanisms.
Other vulnerabilities in Slider by 10Web
See all- CVE-2026-42710High
The Slider by 10Web (slider-wd) plugin contains a blind SQL injection vulnerability. The issue affects versions up to and including 1.2.63.
- CVE-2026-66635High
The Slider by 10Web plugin (versions up to 1.2.63) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions within the application, such as changing slider settings.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS