Skip to content
Nextendweb vulnerabilities
Newest
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
CVE-2026-14876
6.4 Medium
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
CVE-2026-15798
6.4 Medium
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
CVE-2026-12385
4.3 Medium
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
CVE-2026-9197
4.9 Medium
-
nextendweb smart slider 3 pro for joomla, smart slider 3 pro for wordpress +1 more
Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit
CVE-2026-34424
9.3 Critical
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
CVE-2026-4065
5.4 Medium
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
CVE-2026-3098
Public exploit
6.5 Medium
-
nextendweb nextend social login and register
Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
CVE-2025-13737
4.3 Medium
-
nextendweb nextend facebook connect
WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability
CVE-2025-58031
6.5 Medium
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter
CVE-2025-6348
4.9 Medium
-
nextendweb nextend social login pro
Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider
CVE-2025-1061
9.8 Critical
-
nextendweb nextend social login pro
Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider
CVE-2024-9893
9.8 Critical
-
nextendweb smart slider 3
Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload
CVE-2024-3027
6.4 Medium
-
nextendweb nextend social login and register, nextend social login +1 more
Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description
CVE-2024-1775
5.4 Medium
-
nextend smart slider 3
WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection
CVE-2022-45845
4.3 Medium
-
nextendweb smart slider 3
Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS
CVE-2023-0660
5.4 Medium
-
nextend smart slider 3
WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)
CVE-2022-45843
5.4 Medium
-
nextendweb smart slider 3
Smart Slider 3 < 3.5.1.11 - PHP Object Injection
CVE-2022-3357
Public exploit
8.8 High
-
nextend smart slider 3, nextendweb smart slider +1 more
Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)
CVE-2021-24382
5.4 Medium
-
nextendweb nextend twitter connect
Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend...
CVE-2015-4557
6.1 Medium
-
nextendweb facebook connect
Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook...
CVE-2015-4413
4.3 Medium
-
nextendweb nextend facebook connect
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook...
CVE-2014-8800
Public exploit
4.3 Medium