Live › vulnerability › CVE-2026-78527
The GS Testimonial Slider WordPress plugin, versions up to 3.3.10, has a PHP object injection flaw reachable by users with the Contributor role. The sources say an attacker with that role can inject serialized PHP objects, which can lead to code execution depending on the site's other code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the GS Testimonial Slider plugin at version 3.3.10 or earlier. The flaw needs a logged-in account with the Contributor role, so sites with no contributor accounts are lower risk. The sources do not say whether default configurations are affected.
No product ranges from the sources yet.
wp plugin get gs-testimonial-slider --field=version (plugin slug assumed; unknown from sources).3.3.10 (the fixed version is not stated in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-78527")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.