Nextendweb vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20254
3. 20267

Newest CVEs

• CVE-2026-14876

  Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block

  nextendweb · Smart Slider 3

  Medium6.4
• CVE-2026-15798

  Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute

  nextendweb · Smart Slider 3

  Medium6.4
• CVE-2026-12385

  Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter

  nextendweb · Smart Slider 3

  Medium4.3
• CVE-2026-9197

  Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export

  nextendweb · Smart Slider 3

  Medium4.9
• CVE-2026-34424

  Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit

  Nextendweb · Smart Slider 3 Pro for WordPress

  Critical9.3
• CVE-2026-4065

  Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation

  nextendweb · Smart Slider 3

  Medium5.4
• CVE-2026-3098

  Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll

  nextendweb · Smart Slider 3

  Medium6.5
• CVE-2025-13737

  Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login

  nextendweb · Nextend Social Login and Register

  Medium4.3
• CVE-2025-58031

  WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability

  Nextendweb · Nextend Facebook Connect

  Medium6.5
• CVE-2025-6348

  Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter

  nextendweb · Smart Slider 3

  Medium4.9