Now officially on WordPress.org

CVE Database / CVE-2026-39467

CVE · High

CVE-2026-39467 — Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.107.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-39467 Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider [ml-slider] < 3.107.0 Deserialization of Untrusted Data High 7.2 < 3.107.0 3.107.0 2026-04-20 —

CVE-2026-39467

The MetaSlider plugin for WordPress contains a flaw that allows authenticated users with editor-level access and above to inject malicious PHP objects through untrusted input deserialization in versions up to 3.106.0. This vulnerability could be exploited further if an additional plugin or theme on the system has a pre-existing POP chain, potentially enabling attackers to erase files, obtain confidential information, or run code.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings