CVE-2022-3357: Smart Slider 3 < 3.5.1.11 - PHP Object Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-31 · updated 2026-06-17
Weakness: CWE-502

Description

The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.

Affected products

nextendweb Smart Slider 3: before 3.5.1.11 — fixed in 3.5.1.11

How to fix

Upgrade to a fixed version: nextendweb Smart Slider 3 3.5.1.11. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/2e28a4e7-e7d3-485c-949c-e300e5b66cbd
https://wpscan.com/vulnerability/2e28a4e7-e7d3-485c-949c-e300e5b66cbd

Get alerted when CVE-2022-3357 or the next vulnerability affects your stack