Depicter — Popup & Slider Builder
depicter · plugin
Known security vulnerabilities for Depicter — Popup & Slider Builder. Find out in seconds which version runs on your site with WP Lens.
16 known vulnerabilities
1 critical · 8 exploitable without logging in · 1 with public exploit code · latest Aug 18, 2026
Listed on wordpress.org · latest 4.8.1 · last updated Aug 27, 2026 · 80K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2024-47359unauthenticated≤ 3.2.2
WordPress Depicter plugin <= 3.2.2 - Broken Access Control vulnerability
- High 8.8
CVE-2023-51491unauthenticated · needs a click≤ 2.0.6
WordPress Depicter Slider plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability
- High 8.8
CVE-2024-4389contributor+≤ 3.1.1
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authentica
- High 7.5
CVE-2026-66622unauthenticated≤ 4.8.0
WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
- High 7.5
CVE-2025-2011unauthenticated≤ 3.6.1
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
- Medium 6.5
CVE-2025-68558unauthenticated≤ 4.0.4
WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability
- Medium 6.5
CVE-2024-4390contributor+≤ 3.0.2
Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation
- Medium 6.4
CVE-2024-4633author+≤ 3.2.1
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticat
- Medium 5.4
CVE-2024-37414high privilege≤ 3.0.2
WordPress Depicter Slider plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
- Medium 5.3
CVE-2025-11370unauthenticated≤ 4.0.7
Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates
- Medium 4.8
CVE-2024-47381high privilege≤ 3.2.2
WordPress Slider & Popup Builder by Depicter plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability
- Medium 4.8
CVE-2024-43161high privilege≤ 3.1.2
WordPress Slider & Popup Builder by Depicter plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability
- Medium 4.3
CVE-2025-8383unauthenticated · needs a click≤ 4.0.4
Depicter <= 4.0.4 - Cross-Site Request Forgery
- Medium 4.3
CVE-2023-6493unauthenticated · needs a click≤ 2.0.6
Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save
- Medium 4.3
CVE-2022-47176login required≤ 1.9.0
WordPress Depicter Slider plugin <= 1.9.0 - Broken Access Control vulnerability
- Medium 4.3
CVE-2025-11373contributor+≤ 4.0.4
Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Mis
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).