blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-10735

HIGH 7.5 CVSS 3.1
Published
June 24, 2026
Last modified
October 25, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Affected products and versions

  • Unknown smart-post-show-pro — From 4.0.1 (including) to 4.0.2 (excluding)
  • Unknown Real Testimonials Pro — From 3.2.4 (including) to 3.2.5 (excluding)
  • Unknown Product Slider for WooCommerce Pro — From 3.5.2 (including) to 3.5.3 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/160ee7f7-91b6-4cce-9462-837130621402/
  • nvd.nist.gov Official NVD record