CVE-2023-2359: The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some serv

high Affects slider-revolution (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-06-19; advisory modified 2026-06-17.

The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some serv

Package: slider-revolution (WordPress plugin) WordPress
Affected versions: <=6.6.12
Fixed in: no fix recorded
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 3% (84.9th percentile)
Published: 2023-06-19
Source: nvd

References

CWE-94

NVD record slider-revolution (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2014-9735 high The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbi same package: slider-revolution (WordPress plugin)
CVE-2015-5151 medium Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 same package: slider-revolution (WordPress plugin)
CVE-2023-6528 high The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least same package: slider-revolution (WordPress plugin)
CVE-2024-4092 medium The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi same package: slider-revolution (WordPress plugin)
CVE-2024-8107 medium The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi same package: slider-revolution (WordPress plugin)
CVE-2024-4581 medium The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi same package: slider-revolution (WordPress plugin)