CVE-2026-49777
A critical flaw in Product Slider Pro for WooCommerce lets attackers inject malicious software by exploiting improper validation of quantity inputs. The vulnerability exists in all versions before 3.5.4 and can be exploited remotely without authentication. Upgrading to 3.5.4 or later removes the risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
WordPress sites that use the Product Slider Pro for WooCommerce plugin, specifically versions earlier than 3.5.4.
Real-world impact
An attacker could inject code that runs on the site, potentially taking full control, stealing data, or defacing content.
Why this severity
The CVSS score of 10 reflects that the flaw can be exploited over the network with no authentication, changes the scope of the system, and can completely compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Product Slider Pro for WooCommerce to version 3.5.4 or later.
NVD description indicates fix in version 3.5.4 or later.
Timeline
- Jun 5, 2026 · Jun 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.