Critical severity · published Jun 5, 2026
CVE-2026-49777
WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
10.0
CVSS
1.7%
EPSS
No
On KEV
Description
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.
This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Product Slider Pro for WooCommerce · ShapedPlugin, LLC
before 3.5.4 · source: vendor
Affected product
PS
Product Slider Pro for WooCommerce
ShapedPlugin, LLC
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49777
patchstack.com
https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability?_s_id=cve