https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T04:13:33.808185+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-284177 EUVD-2026-284177 2026-10-05T04:13:33.855323+00:00 EUVD-2026-284177 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4065 fkie_cve-2026-4065 2026-10-05T04:13:33.855358+00:00

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.

 https://cve.radiocsirt.org/vuln/ghsa-m7hj-m974-fx49 GHSA-m7hj-m974-fx49 2026-10-05T04:13:33.855393+00:00

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.