CVE-2026-66635
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Slider by 10Web plugin (versions up to 1.2.63) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions within the application, such as changing slider settings.
Risk Assessment
CSRF can lead to unauthorized configuration changes, content modification, or other actions on behalf of the victim. In the case of an administrator, this could result in site takeover.
Recommendation
Update the Slider by 10Web plugin to the latest version that includes CSRF fixes. In the meantime, consider implementing anti-CSRF tokens or additional request verification mechanisms.
Other vulnerabilities in Slider by 10Web
See all- CVE-2026-105885High
Slider by 10Web through version 1.2.62 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.
- CVE-2026-42710High
The Slider by 10Web (slider-wd) plugin contains a blind SQL injection vulnerability. The issue affects versions up to and including 1.2.63.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS