Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Smart Slider 3 — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in Smart Slider 3, with AI-generated Chinese analysis, references, and POCs.

Vendor: Nextend

CVE ID Title CVSS Severity Published
CVE-2026-14876 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block CWE-79 6.4 Medium 2026-09-30
CVE-2026-15798 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute CWE-79 6.4 Medium 2026-08-28
CVE-2026-12385 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter CWE-200 4.3 Medium 2026-07-13
CVE-2026-9197 Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export CWE-22 4.9 Medium 2026-06-06
CVE-2026-4065 Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation CWE-862 5.4 Medium 2026-04-07
CVE-2026-3098 Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll CWE-862 6.5 Medium 2026-03-27
CVE-2025-6348 Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter CWE-89 4.9 Medium 2025-07-30
CVE-2024-3027 Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload CWE-285 6.4 Medium 2024-04-13
CVE-2022-45845 WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection CWE-502 4.3 Medium 2024-01-19
CVE-2023-0660 Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS 5.4 - 2023-03-27
CVE-2022-45843 WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS) CWE-79 5.4 Medium 2023-03-23
CVE-2022-3357 Smart Slider 3 < 3.5.1.11 - PHP Object Injection CWE-502 9.8 - 2022-10-31
CVE-2021-24382 Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS) CWE-79 4.8 - 2021-06-14

All 13 known CVE vulnerabilities affecting Smart Slider 3 with full Chinese analysis, references, and POCs where available.