HomeWordPress vulnerabilitiesSlider by 10Web
Slider by 10Web vulnerabilities
Slider by 10Web has 9 known vulnerabilities in this database. The most recent published record is dated 7 Oct 2026.
- Known vulnerabilities
- 9
- Active installs
- 10,000+
- Latest version
- 1.2.62
- Last updated
- 26 Dec 2024
- Most recent
- 7 Oct 2026
No fixed version has been published yet, so consider disabling, removing or replacing the plugin until a safe release is available.
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| SQL injection CVE-2026-42710 | High 7.6 | Up to 1.2.63 | No fixed version yet | 11 h ago |
| Cross-site request forgery (CSRF) CVE-2026-66635 | High 7.4 | Up to 1.2.63 | No fixed version yet | 18 Aug 2026 |
| Cross-site scripting (XSS) CVE-2024-10565 | Medium 6.1 | Before 1.2.62 | Fixed in 1.2.62 | 25 Mar 2025 |
| Cross-site scripting (XSS) CVE-2024-10566 | Medium 6.1 | Before 1.2.62 | Fixed in 1.2.62 | 25 Mar 2025 |
| Cross-site scripting (XSS) CVE-2024-8283 | Medium 4.8 | Before 1.2.59 | Fixed in 1.2.59 | 30 Sep 2024 |
| SQL injection CVE-2024-7150 | High 8.8 | Before 1.2.58 | Fixed in 1.2.58 | 8 Aug 2024 |
| Cross-site scripting (XSS) CVE-2024-6408 | Medium 5.4 | Before 1.2.57 | Fixed in 1.2.57 | 31 Jul 2024 |
| Cross-site scripting (XSS) CVE-2024-6026 | Medium 5.4 | Before 1.2.56 | Fixed in 1.2.56 | 11 Jul 2024 |
| SQL injection CVE-2021-24132 | High 8.8 | Before 1.2.36 | Fixed in 1.2.36 | 18 Mar 2021 |
Read the published descriptions
- CVE-2026-42710, 7 Oct 2026
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63. CVE record
- CVE-2026-66635, 18 Aug 2026
- Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63. CVE record
- CVE-2024-10565, 25 Mar 2025
- The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-10566, 25 Mar 2025
- The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-8283, 30 Sep 2024
- The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-7150, 8 Aug 2024
- The Slider by 10Web - Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-6408, 31 Jul 2024
- The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed CVE record
- CVE-2024-6026, 11 Jul 2024
- The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and the ability to add images (Editor+) to perform Stored Cross-Site Scripting attacks CVE record
- CVE-2021-24132, 18 Mar 2021
- The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks. CVE record
What to do if you run Slider by 10Web
If you run Slider by 10Web, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Slider by 10Web vulnerabilities
Free. We email you when a new vulnerability is published for Slider by 10Web, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.