SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Slider Revolution — verificado contra la base de datos de seguridad local de WP Clinic.
revslidercarousel slidergalleryimage sliderslidervideo slider
22 CVEs conocidos registrados para Slider Revolution.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-57678 | Slider Revolution [revslider] < 7.1.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 7.1.0 | 7.1.0 | 2026-06-30 | ⚠ necesita actualización |
| CVE-2026-7542 | Slider Revolution [revslider] < 7.0.11 | Exposición de información sensible a un actor no autorizado | Media 6,5 | < 7.0.11 | 7.0.11 | 2026-06-08 | ⚠ necesita actualización |
| CVE-2026-9050 | Slider Revolution [revslider] < 6.7.56 | Falta de control de autorización | Media 4,3 | < 6.7.56 | 6.7.56 | 2026-06-01 | ⚠ necesita actualización |
| CVE-2026-9048 | Slider Revolution [revslider] < 7.0.15 | Autorización incorrecta | Media 4,3 | < 7.0.15 | 7.0.15 | 2026-06-01 | ⚠ necesita actualización |
| CVE-2026-6728 | Slider Revolution [revslider] < 7.0.10 | Exposición de información sensible a un actor no autorizado | Media 5,3 | < 7.0.10 | 7.0.10 | 2026-05-19 | ⚠ necesita actualización |
| CVE-2026-6692 | Slider Revolution [revslider] < 7.0.11 | Carga de archivos sin restricción de tipo peligroso | Alta 8,8 | < 7.0.11 | 7.0.11 | 2026-05-06 | ⚠ necesita actualización |
| CVE-2025-10249 | Slider Revolution [revslider] < 6.7.38 | Path Traversal relativo (recorrido de ruta relativa) | Media 6,5 | < 6.7.38 | 6.7.38 | 2025-10-08 | ⚠ necesita actualización |
| CVE-2024-8107 | Slider Revolution [revslider] < 6.7.19 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 6.7.19 | 6.7.19 | 2024-09-30 | ⚠ necesita actualización |
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 7.0.0-7.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions 7.0 to 7.0.10. This is due to three compounding design flaws: (1) the plugin leaks a valid backend AJAX nonce (revslider_actions) to all authenticated users including Subscribers via the admin_footer hook; (2) the wordpress.create.image_from_url action is explicitly allowlisted in the $user_allowed array, bypassing the administrator-only access control; (3) the create_wordpress_image_from_url() function accepts an attacker-controlled url parameter that is passed to import_media(), where path_or_url_exists() explicitly accepts local filesystem paths (file_exists() && is_readable()) with no restriction to remote HTTP/HTTPS URLs, and @copy() physically copies those files into the publicly accessible /wp-content/uploads/revslider/ai/ directory. The MIME type check trusts the attacker-supplied content_type parameter to derive the destination extension without verifying actual file content, and the source extension blacklist does not block many sensitive types (.sql, .log, .json, .bak, .xml, .csv, .conf, .yml, .yaml, .pem, .key, .crt, .txt, .db, etc.). This makes it possible for authenticated attackers with Subscriber-level access and above to read the contents of server files with non-blacklisted extensions by having them copied to a publicly accessible URL.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to deactivate any active plugin installed on the site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw social media API credentials: the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID, stored in any configured slider's settings.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.9 via the 'get_stream_data()' function. This makes it possible for unauthenticated attackers to extract sensitive data including published password-protected post, page, and product content.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function. This is due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The vulnerability was partially patched in version 7.0.10 and fully patched in version 7.0.11.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. By default, this can only be exploited by administrators, but the ability to use and configure Slider Revolution can be extended to authors.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2024-37449 | Slider Revolution [revslider] < 6.7.14 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,9 | < 6.7.14 | 6.7.14 | 2024-06-28 | ⚠ necesita actualización |
| CVE-2024-4581 | Slider Revolution [revslider] < 6.7.11 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 6.7.11 | 6.7.11 | 2024-06-03 | ⚠ necesita actualización |
| CVE-2024-4637 | Slider Revolution [revslider] < 6.7.11 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 6.7.11 | 6.7.11 | 2024-06-03 | ⚠ necesita actualización |
| CVE-2024-34444 | Slider Revolution [revslider] < 6.7.0 | Falta de control de autorización | Alta 7,1 | < 6.7.0 | 6.7.0 | 2024-05-28 | ⚠ necesita actualización |
| CVE-2024-34443 | Slider Revolution [revslider] < 6.7.11 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,9 | < 6.7.11 | 6.7.11 | 2024-05-28 | ⚠ necesita actualización |
| CVE-2024-4092 | Slider Revolution [revslider] < 6.7.8 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 6.7.8 | 6.7.8 | 2024-04-30 | ⚠ necesita actualización |
| CVE-2024-2306 | Slider Revolution [revslider] < 6.7.0 | Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) | Media 6,4 | < 6.7.0 | 6.7.0 | 2024-04-08 | ⚠ necesita actualización |
| CVE-2023-6528 | Slider Revolution [revslider] < 6.6.19 | Control incorrecto de la generación de código (inyección de código) | Alta 8,8 | < 6.6.19 | 6.6.19 | 2023-11-30 | ⚠ necesita actualización |
| — | Slider Revolution [revslider] < 3.0.96 | — | Desconocido | < 3.0.96 | 3.0.96 | 2023-11-26 | ✓ corregido en la última versión |
| CVE-2023-47784 | Slider Revolution [revslider] < 6.6.16 | Carga de archivos sin restricción de tipo peligroso | Alta 8,4 | < 6.6.16 | 6.6.16 | 2023-11-14 | ⚠ necesita actualización |
| CVE-2023-47772 | Slider Revolution [revslider] < 6.6.15 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,5 | < 6.6.15 | 6.6.15 | 2023-11-14 | ⚠ necesita actualización |
| CVE-2023-2359 | Slider Revolution [revslider] < 6.6.13 | Control incorrecto de la generación de código (inyección de código) | Alta 8,8 | < 6.6.13 | 6.6.13 | 2023-05-22 | ⚠ necesita actualización |
| CVE-2015-1579 | Slider Revolution [revslider] < 4.1.5 (unfixed) | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Desconocido | < 4.1.5 | 4.1.5 | 2015-02-11 | ⚠ necesita actualización |
| CVE-2015-5151 | Slider Revolution [revslider] < 4.2.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 4.2.3 | 4.2.3 | 2014-12-17 | ⚠ necesita actualización |
| — | Slider Revolution [revslider] < 3.0.96 | — | Desconocido | < 3.0.96 | 3.0.96 | 2014-11-26 | ✓ corregido en la última versión |
| CVE-2014-9735 | Slider Revolution [revslider] < 3.0.96 | — | Desconocido | < 3.0.96 | 3.0.96 | 2014-11-25 | ✓ corregido en la última versión |
| — | Slider Revolution [revslider] < 6.7.37 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 6,5 | < 6.7.37 | 6.7.37 | 0000-00-00 | ⚠ necesita actualización |
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.7.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up to, and including, 6.7.11 due to insufficient input sanitization and output escaping on the user supplied 'class', 'id', and 'title' attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation of this vulnerability requires an Administrator to give Slider Creation privileges to Author-level users.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping on the user supplied Elementor 'wrapperid' and 'zindex' display attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Slider Revolution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_rest_api function in versions up to 6.7.0. This makes it possible for unauthenticated attackers to update slider data.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, and including, 6.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Slider Revolution can be extended to authors.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Update the WordPress Slider Revolution plugin to the latest available version (at least 6.7.0). wesley (wcraft) , Nikolas - mdr discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Slider Revolution Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.7.0. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Slider Revolution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 6.6.19 (exclusive) via deserialization of untrusted input when importing a new slider. This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Update the plugin. Simo Ben Youssef discovered and reported this Remote File Inclusion vulnerability in WordPress Slider Revolution Plugin. This could allow a malicious actor to get a website to load an external website or script which will then be executed on the website. This could allow the malicious actor to create backdoors on the site or take full control of the website. This vulnerability has been fixed in version 3.0.96.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Slider Revolution plugin to the latest available version (at least 6.6.16). Rafie Muhammad (Patchstack) discovered and reported this Arbitrary File Upload vulnerability in WordPress Slider Revolution Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 6.6.16.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Slider Revolution plugin to the latest available version (at least 6.6.15). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Slider Revolution Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.6.15.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Slider Revolution plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in versions up to, and including, 6.6.12. This makes it possible for authenticated attackers with administrator-level attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the default settings allow only administrators to exploit this vulnerability, this privilege can be granted to users as low as author.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Update the plugin. indoushka discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Slider Revolution Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.2.3.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
This plugin cannot check authentication in revslider_admin.php/showbiz_admin.php which allows an attacker to abuse administrative features (for the example, creating or deleting sliders, importing or exporting sliders, etc.). Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors. Several WordPress themes utilize revslider which makes them vulnerable as well.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Mantén Slider Revolution actualizado — 3.110.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.