CVE-2019-15866: Crelly Slider Project Crelly Slider

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.

Affected products

• Crelly Slider Project Crelly Slider: before 1.3.5 (fixed in 1.3.5)

Published 2019-09-03. Last modified 2026-06-17.