CVE-2026-105885— WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
Quick assessment
Affected
10Web Slider by 10Web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
10Web Slider 插件（由 10Web slider-wd 组件实现）中存在“不受信任数据的反序列化”漏洞，可导致对象注入。该漏洞影响 Slider by 10Web 的所有版本，从未知初始版本至 1.2.62 版。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 10Web | Slider by 10Web | ≤ 1.2.62 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105885
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 10Web | Slider by 10Web | 0 ~ 1.2.62 | - |
|
II. Public POCs for CVE-2026-105885
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105885
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105885 (1)
Same Patch Batch · 10Web · 2026-10-10 · 5 CVEs total
| CVE-2026-107742 | 7.2 HIGH | 10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author N |
| CVE-2026-42711 | 7.1 HIGH | WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-42715 | 7.1 HIGH | WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerabili |
| CVE-2026-103998 | 6.1 MEDIUM | Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Arr |
IV. Related Vulnerabilities
Same product: Slider by 10Web
-
CVE-2026-42711
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scri -
CVE-2026-42710
WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection v -
CVE-2026-66635
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Requ -
CVE-2024-10566
Slider by 10Web < 1.2.62 - Contributor+ Stored XSS -
CVE-2024-10565
Slider by 10Web < 1.2.62 - Admin+ Stored XSS via Widget
Same vendor: 10Web
-
CVE-2026-42715
WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Si -
CVE-2026-42711
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scri -
CVE-2026-107742
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site -
CVE-2026-103998
Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Script -
CVE-2026-42710
WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection v
Same weakness: CWE-502
-
CVE-2026-81797
WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme -
CVE-2026-78535
WordPress Photolia theme <= 1.0.3 - PHP Object Injection vul -
CVE-2026-78533
WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulner -
CVE-2026-78531
WordPress Jacqueline theme <= 2.22 - PHP Object Injection vu -
CVE-2026-78529
WordPress Alliance theme <= 3.11 - PHP Object Injection vuln
V. Comments for CVE-2026-105885
No comments yet