Search criteria

4 vulnerabilities found for Depicter — Popup & Slider Builder by averta

CVE-2025-11370 (GCVE-0-2025-11370)

Vulnerability from nvd – Published: 2026-01-06 03:21 – Updated: 2026-01-06 15:02
VLAI?
Title
Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates
Summary
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
averta Depicter — Popup & Slider Builder Affected: * , ≤ 4.0.7 (semver)
Create a notification for this product.
Credits
Brizzle
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T15:01:50.835756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T15:02:56.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Depicter \u2014 Popup \u0026 Slider Builder",
          "vendor": "averta",
          "versions": [
            {
              "lessThanOrEqual": "4.0.7",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brizzle"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027store\u0027 function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T03:21:40.305Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d35faf39-4882-4393-9b77-57dc45ac9d04?source=cve"
        },
        {
          "url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/RulesAjaxController.php"
        },
        {
          "url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/ajax.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3428118/depicter/trunk/app/routes/ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-07T11:18:32.000+00:00",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-01-05T15:17:33.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "Depicter \u003c= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11370",
    "datePublished": "2026-01-06T03:21:40.305Z",
    "dateReserved": "2025-10-06T14:00:15.658Z",
    "dateUpdated": "2026-01-06T15:02:56.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-8383 (GCVE-0-2025-8383)

Vulnerability from nvd – Published: 2025-10-31 08:25 – Updated: 2025-12-22 17:22
VLAI?
Title
Depicter <= 4.0.4 - Cross-Site Request Forgery
Summary
The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
averta Depicter — Popup & Slider Builder Affected: * , ≤ 4.0.4 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8383",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T17:22:28.186222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T17:22:32.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Depicter \u2014 Popup \u0026 Slider Builder",
          "vendor": "averta",
          "versions": [
            {
              "lessThanOrEqual": "4.0.4",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T15:40:16.289Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=cve"
        },
        {
          "url": "https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZWZe3gYjqo/view?usp=sharing"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/depicter/trunk/app/routes/ajax.php#L473"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3384613/"
        },
        {
          "url": "https://research.cleantalk.org/cve-2025-8383/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-07T11:18:32.000+00:00",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-30T20:18:20.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "Depicter \u003c= 4.0.4 - Cross-Site Request Forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-8383",
    "datePublished": "2025-10-31T08:25:55.580Z",
    "dateReserved": "2025-07-30T18:13:07.830Z",
    "dateUpdated": "2025-12-22T17:22:32.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-11370 (GCVE-0-2025-11370)

Vulnerability from cvelistv5 – Published: 2026-01-06 03:21 – Updated: 2026-01-06 15:02
VLAI?
Title
Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates
Summary
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
averta Depicter — Popup & Slider Builder Affected: * , ≤ 4.0.7 (semver)
Create a notification for this product.
Credits
Brizzle
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T15:01:50.835756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T15:02:56.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Depicter \u2014 Popup \u0026 Slider Builder",
          "vendor": "averta",
          "versions": [
            {
              "lessThanOrEqual": "4.0.7",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brizzle"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027store\u0027 function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T03:21:40.305Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d35faf39-4882-4393-9b77-57dc45ac9d04?source=cve"
        },
        {
          "url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/RulesAjaxController.php"
        },
        {
          "url": "https://github.com/nguy3nB4oo11/depicter-vuln-repro/blob/main/ajax.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3428118/depicter/trunk/app/routes/ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-07T11:18:32.000+00:00",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-01-05T15:17:33.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "Depicter \u003c= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11370",
    "datePublished": "2026-01-06T03:21:40.305Z",
    "dateReserved": "2025-10-06T14:00:15.658Z",
    "dateUpdated": "2026-01-06T15:02:56.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-8383 (GCVE-0-2025-8383)

Vulnerability from cvelistv5 – Published: 2025-10-31 08:25 – Updated: 2025-12-22 17:22
VLAI?
Title
Depicter <= 4.0.4 - Cross-Site Request Forgery
Summary
The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
averta Depicter — Popup & Slider Builder Affected: * , ≤ 4.0.4 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8383",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T17:22:28.186222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T17:22:32.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Depicter \u2014 Popup \u0026 Slider Builder",
          "vendor": "averta",
          "versions": [
            {
              "lessThanOrEqual": "4.0.4",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T15:40:16.289Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=cve"
        },
        {
          "url": "https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZWZe3gYjqo/view?usp=sharing"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/depicter/trunk/app/routes/ajax.php#L473"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3384613/"
        },
        {
          "url": "https://research.cleantalk.org/cve-2025-8383/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-07T11:18:32.000+00:00",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-30T20:18:20.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "Depicter \u003c= 4.0.4 - Cross-Site Request Forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-8383",
    "datePublished": "2025-10-31T08:25:55.580Z",
    "dateReserved": "2025-07-30T18:13:07.830Z",
    "dateUpdated": "2025-12-22T17:22:32.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}