CVE-2023-37888

CVE-2023-37888 affects the WordPress plugin Shortcodes and extra features for Phlox theme . It is a Path Traversal (PHP Local File Inclusion) vulnerability that allows unauthenticated attackers to include local files. Affected versions are up to and including 2.14.0; the vendor/maintainer fixed i...

CVE-2022-1910

The CVE-2022-1910 is tied to the WordPress Shortcodes and Extra Features for Phlox plugin (pre-2.9.8). The NUCLEI template confirms a cross-site scripting flaw where the plugin does not sanitize/escape a parameter before echoing it in the response. This allows an attacker to inject arbitrary scri...

CVE-2023-7064

The CVE-2023-7064 entry concerns the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements). It describes a PHP Object Injection vulnerability via deserialization of untrusted input from the vulnerable id parameter in the function auxin_template_control_importer, affectin...

CVE-2024-1533

CVE-2024-1533 affects the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements) up to version 2.15.5. It enables Stored Cross-Site Scripting via the HTML Element due to insufficient input sanitization/output escaping. An authenticated attacker with Contributor+ privilege...

CVE-2024-3341

The CVE CVE-2024-3341 (Shortcodes and extra features for Phlox theme plugin, aux_gmaps) is confirmed via connected PatchStack data: Phlox versions up to and including 2.15.7 (patched beyond 2.15.7) are affected by authenticated Stored XSS via the aux_gmaps shortcode. Impact: stored XSS in pages v...

CVE-2024-3517

CVE-2024-3517 corresponds to the WordPress plugin/ theme issue in Shortcodes and extra features for Phlox theme (auxin-elements). Affected: Phlox theme versions up to and including 2.15.5. Root cause: insufficient input sanitization and output escaping in the Accordion Widget (Stored XSS). Impact...

CVE-2024-1396

CVE-2024-1396 affects the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements). It is a stored XSS via the title_tag parameter in versions up to 2.15.5, exploitable by authenticated users with Contributor+ permissions. The issue can cause arbitrary scripts to run when u...

CVE-2024-8486

CVE-2024-8486 affects the WordPress plugin Shortcodes and extra features for Phlox theme (versions

CVE-2024-1357

CVE-2024-1357 affects the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements). It is a Stored XSS in the aux_timeline shortcode caused by insufficient input sanitization and output escaping for attributes like thumb_mode and date_type. Exploitation requires authenticat...

CVE-2024-9545

CVE-2024-9545 : Shortcodes and extra features for Phlox theme store pages vulnerability enabling stored XSS via aux_contact_box and aux_gmaps shortcodes. Affected: Phlox theme (WordPress). Root cause: insufficient input sanitization/output escaping on user-supplied shortcode attributes. Impact: a...

CVE-2022-3359

CVE-2022-3359 affects the Shortcodes and extra features for Phlox theme WordPress plugin, prior to version 2.10.7. The issue arises from unserializing the content of an imported file, enabling PHP object injection if a suitable gadget chain is present on the blog. Affected product: Phlox WordPres...

CVE-2024-50500

CVE-2024-50500 : Missing Authorization in By Averta Shortcodes and Phlox theme features (Shortcodes and extra features for Phlox theme) allows exploitation of insufficient access controls. Affected: WordPress Phlox Core Elements plugin up to version 2.17.2 (and Phlox theme components referenced a...

CVE-2024-1348

CVE-2024-1348 concerns the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements) with Stored Cross-Site Scripting via the custom JS parameter. The vulnerability arises from insufficient input sanitization and output escaping. Affected versions include all up to 2.15.5 (p...

CVE-2024-31099

Technical details about CVE-2024-31099 are not provided in the connected documents. The initial description notes a missing authorization vulnerability affecting Averta Shortcodes/Phlox auxin-elements, but no vendor/version specifics, impact details, or remediation steps are present to cite. Moni...

CVE-2024-12588

CVE-2024-12588 concerns the WordPress plugin Shortcodes and extra features for Phlox theme. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in the Phlox staff widget, arising from insufficient input sanitization and output escaping of user-supplied attributes. Affected...

CVE-2023-50368

CVE-2023-50368 affects the WordPress plugin Shortcodes and extra features for Phlox theme (Averta Shortcodes) up to version 2.15.2. The issue is an improper neutralization of user input during web page generation, enabling Stored XSS. Public records from multiple sources confirm the vulnerability...