{"id":"CVE-2023-6528","aliases":["EUVD-2023-58759","GHSA-q942-jjg3-5jhx"],"status":"published","title":"Slider Revolution \u003c 6.6.19 - Author+ Insecure Deserialization leading to RCE","description":"The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0137,"percentile":0.72113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2024-01-08T19:00:34Z","modified":"2026-06-17T06:50:55Z","products":[{"vendor":"revolution slider","product":"slider revolution"},{"vendor":"themepunch","product":"slider_revolution"},{"vendor":"unknown","product":"slider revolution"}],"references":[{"url":"https://wpscan.com/vulnerability/36ced447-84ea-4162-80d2-6df226cb53cb","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6528"},{"url":"https://github.com/advisories/GHSA-q942-jjg3-5jhx"}],"sources":{"cve":[{"id":"CVE-2023-6528","title":"Slider Revolution \u003c 6.6.19 - Author+ Insecure Deserialization leading to RCE","description":"The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.","status":"published","published":"2024-01-08T19:00:34.654Z","modified":"2025-06-03T14:34:40.468Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-58759","description":"The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.","status":"published","published":"2024-01-08T19:00:34Z","modified":"2025-06-03T14:34:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:31.558173Z"}],"ghsa":[{"id":"GHSA-q942-jjg3-5jhx","title":"The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the...","description":"The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.","status":"published","published":"2024-01-08T21:30:33Z","modified":"2024-01-20T05:06:59Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:55:27.310113Z"}],"nvd":[{"id":"CVE-2023-6528","description":"The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.","status":"published","published":"2024-01-08T19:15:10.273Z","modified":"2026-06-17T06:50:55.287Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:09:00.788714Z"}]}}