CVE-2026-15049

Name of the Vulnerable Software and Affected Versions Depicter — Popup & Slider Builder WordPress plugin versions prior to 4.8.0

Description Users with editor-level access can upload arbitrary files, including executable PHP scripts, into a web-accessible directory. This occurs because the import feature fails to validate the type of uploaded files and does not remove malformed uploads, potentially leading to remote code execution.

Recommendations Update Depicter — Popup & Slider Builder WordPress plugin to version 4.8.0 or later.