← back to popular plugins
wordfence / plugin · depicter
Depicter — Popup & Slider Builder
depicter
total installs
90,000
total vulns
5
critical
0
high
1
medium
4
low
0
latest vuln
—
patched
5
unpatched
0
avg time to patch
—
vulnerabilities
(5)
Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates
medium
✓ patched
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings.
Depicter Slider <= 4.0.4 - Missing Authorization
medium
✓ patched
The Depicter — Popup & Slider Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.0.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload
medium
✓ patched
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability checks in the "depicter-media-upload" AJAX route in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload limited files on the affected site's server.
Depicter <= 4.0.4 - Cross-Site Request Forgery
medium
✓ patched
cve id
CVE-2025-8383 ↗
cvss score
4.3
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Oct 30, 2025
The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
high
✓ patched
cve id
CVE-2025-2011 ↗
cvss score
7.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
May 5, 2025
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.