WordPress Plugin Vulnerabilities

Serious Slider < 1.3.0 - Missing Authorization

Description

The Serious Slider plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
cryout-serious-slider
Fixed in 1.3.0

References

CVE
CVE-2026-25399
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/73418252-ce07-4872-97ae-c6ea71c2105b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
f25f10f5-489e-406c-a500-f4fbc1a65710

Timeline

Publicly Published
2026-01-30 (about 7 months ago)
Added
2026-02-26 (about 6 months ago)
Last Updated
2026-03-17 (about 6 months ago)

Other

Published
Title
Published
2026-01-08
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.4 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Addons Installation
Published
2024-08-09
Title
WP Search Analytics < 1.4.10 - Missing Authorization
Published
2026-04-03
Title
Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.9 - Missing Authorization to Unauthenticated Registration Form Status Modification
Published
2022-08-25
Title
Event Calendar < 1.4.7 - Unauthenticated Arbitrary Event Deletion