CVE-2026-9197

Name of the Vulnerable Software and Affected Versions Smart Slider 3 versions prior to 3.5.1.37

Description The Smart Slider 3 plugin for WordPress contains a Directory Traversal flaw within the replaceHTMLImage() function. This allows authenticated attackers with administrator-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. Directory Traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update the plugin to a version later than 3.5.1.36. As a temporary workaround, restrict access to the replaceHTMLImage() function to minimize the risk of exploitation.