Skip to contentNextendweb Smart Slider 3 vulnerabilities
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML BlockCVE-2026-148766.4 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block AttributeCVE-2026-157986.4 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' ParameterCVE-2026-123854.3 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML ExportCVE-2026-91974.9 Medium
- nextendweb smart slider 3 pro for joomla, smart slider 3 pro for wordpress +1 moreSmart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitCVE-2026-344249.3 Critical
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record ManipulationCVE-2026-40655.4 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAllCVE-2026-3098Public exploit6.5 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` ParameterCVE-2025-63484.9 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File UploadCVE-2024-30276.4 Medium
- nextend smart slider 3WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object InjectionCVE-2022-458454.3 Medium
- nextendweb smart slider 3Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSSCVE-2023-06605.4 Medium
- nextend smart slider 3WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)CVE-2022-458435.4 Medium
- nextendweb smart slider 3Smart Slider 3 < 3.5.1.11 - PHP Object InjectionCVE-2022-3357Public exploit8.8 High
- nextend smart slider 3, nextendweb smart slider +1 moreSmart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-243825.4 Medium