CVE-2026-0635

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify any slider's image metadata including titles, descriptions, alt text, and links.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-06366.5Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JA CVE-2026-06374.4When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging oc CVE-2026-06395.5in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2026-06409.8A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a man CVE-2026-06418.8A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the CVE-2026-06426.1A vulnerability was detected in projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file CVE-2026-06439.8A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?CVE-2026-06468.7A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulne CVE-2026-06478.8An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenti CVE-2026-06486.3The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers CVE-2026-06494.7A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Ut CVE-2026-06509.3OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper hand