CVE-2022-3357

The Smart Slider 3 plugin through version 3.5.1.9 contains a PHP Object Injection vulnerability that occurs during file import operations due to unsafe deserialization of untrusted data. Attackers with administrator privileges can exploit this to inject malicious PHP objects, and while the plugin itself lacks a gadget chain for exploitation, the presence of such chains in other installed plugins or themes could enable attackers to perform arbitrary file deletion, access confidential information, or achieve remote code execution.

Based on public CVE data (MITRE/NVD).