CVE-2026-10735

ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

State: Published
Severity: 7.5 High
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 3, 2026

Description

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
smart-post-show-proUnknown	4.0.1 to before 4.0.2Affected
Real Testimonials ProUnknown	3.2.4 to before 3.2.5Affected
Product Slider for WooCommerce ProUnknown	3.5.2 to before 3.5.3Affected

References

https://wpscan.com/vulnerability/160ee7f7-91b6-4cce-9462-837130621402/exploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.