CVE-2026-10735

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/160ee7f7-91b6-4cce-9462-837130621402/

Configurations

No configuration.

History

24 Jun 2026, 14:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

24 Jun 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-24 07:16

Updated : 2026-06-25 19:07

NVD link : CVE-2026-10735

Mitre link : CVE-2026-10735

CVE.ORG link : CVE-2026-10735

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-10735", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10735", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T13:07:14.060006Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "smart-post-show-pro", "versions": [{"status": "affected", "version": "4.0.1", "lessThan": "4.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "Real Testimonials Pro", "versions": [{"status": "affected", "version": "3.2.4", "lessThan": "3.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "Product Slider for WooCommerce Pro", "versions": [{"status": "affected", "version": "3.5.2", "lessThan": "3.5.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-24T07:16:25.867", "references": [{"url": "https://wpscan.com/vulnerability/160ee7f7-91b6-4cce-9462-837130621402/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites."}], "lastModified": "2026-06-25T19:07:56.657", "sourceIdentifier": "contact@wpscan.com"}