CVE-2021-24132: Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-89

Description

The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks.

Affected products

Slider by 10Web: before 1.2.36 — fixed in 1.2.36

How to fix

Upgrade to a fixed version: Slider by 10Web 1.2.36. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/c1f45000-6c16-4606-be80-1938a755af2c
https://wpscan.com/vulnerability/c1f45000-6c16-4606-be80-1938a755af2c

Get alerted when CVE-2021-24132 or the next vulnerability affects your stack