CVE-2014-9735

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro...

7.5 HighPublic exploit

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

Exploit likelihood

75.6%Down 9.8 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2014-9735
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-9735
Updated: 2026-11-02

EUVDEUVD-2014-9541 No score

Record: EUVD-2014-9541
Updated: 2026-11-03

GitHub AdvisoriesGHSA-86x3-cgp4-637q No score

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro...

Record: GHSA-86x3-cgp4-637q
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin RevSlider 3.0.95 - Arbitrary File Upload / Execution (Metasploit)	2015-05-08
Metasploit	WordPress RevSlider File Upload and Execute Vulnerability	2014-11-26
Nuclei	WordPress RevSlider - Remote Code Execution via File Upload

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9735 is a high vulnerability (CVSS 7.5) in Themepunch Showbiz Pro, published June 30, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.6%, the 99th percentile. No source names a fixed version.