Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter

Wordfence Intelligence   >   Vulnerability Database   >   Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE CVE-2025-2011
CVSS 7.5 (High)
Publicly Published May 5, 2025
Last Updated May 6, 2025
Researcher Muhamad Visat

Description

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Learn more about SQL Injection vulnerabilities and how to prevent them.

References

Share

Vulnerability Details for Depicter — Popup & Slider Builder

Depicter — Popup & Slider Builder

Software Type Plugin
Software Slug depicter (view on wordpress.org)
Patched? Yes
Remediation Update to version 3.6.2, or a newer patched version
Affected Version
  • <= 3.6.1
Patched Version
  • 3.6.2

Recent vulnerabilities in Depicter — Popup & Slider Builder

Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates
5.3
CVE-2025-11370
Jan 5, 2026
Researcher: Brizzle
Depicter Slider <= 4.0.4 - Missing Authorization
5.3
CVE-2025-68558
Jan 5, 2026
Researcher: Edisc1
Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload
4.3
CVE-2025-11373
Nov 4, 2025
Researcher: Rafshanzani Suhada
Depicter <= 4.0.4 - Cross-Site Request Forgery
4.3
CVE-2025-8383
Oct 30, 2025
Researcher: Dmitrii Ignatyev
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-4633
Dec 5, 2024
Researcher: wesley (wcraft)
Depicter Slider <= 3.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-47381
Sep 30, 2024
Researcher: SavPhill (Savphill)
Depicter Slider <= 3.2.2 - Missing Authorization
5.3
CVE-2024-47359
Sep 30, 2024
Researcher: Rafie Muhammad
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVE-2024-4389
Aug 13, 2024
Researcher: Arkadiusz Hydzik
Depicter Slider <= 3.1.2 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-43161
Aug 7, 2024
Researcher: SavPhill (Savphill)
Depicter Slider <= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2024-37414
Jun 28, 2024
Researcher: Steven Julian
# Title CVE ID CVSS Researchers Date
1 Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates CVE-2025-11370 5.3 Brizzle January 5, 2026
2 Depicter Slider <= 4.0.4 - Missing Authorization CVE-2025-68558 5.3 Edisc1 January 5, 2026
3 Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload CVE-2025-11373 4.3 Rafshanzani Suhada November 4, 2025
4 Depicter <= 4.0.4 - Cross-Site Request Forgery CVE-2025-8383 4.3 Dmitrii Ignatyev October 30, 2025
5 Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-4633 6.4 wesley (wcraft) December 5, 2024
6 Depicter Slider <= 3.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-47381 4.4 SavPhill (Savphill) September 30, 2024
7 Depicter Slider <= 3.2.2 - Missing Authorization CVE-2024-47359 5.3 Rafie Muhammad September 30, 2024
8 Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload CVE-2024-4389 8.8 Arkadiusz Hydzik August 13, 2024
9 Depicter Slider <= 3.1.2 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-43161 4.4 SavPhill (Savphill) August 7, 2024
10 Depicter Slider <= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting CVE-2024-37414 4.4 Steven Julian June 28, 2024
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation