What’s Vulnerable › Products
nextendweb Smart Slider 3 vulnerabilities
12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Check whether your nextendweb Smart Slider 3 version is affected
Latest nextendweb Smart Slider 3 vulnerabilities
- CVE-2026-14876 — Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block (CVSS 6.4)
- CVE-2026-15798 — Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute (CVSS 6.4)
- CVE-2026-12385 — Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter (CVSS 4.3)
- CVE-2026-9197 — Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export (CVSS 4.9)
- CVE-2026-4065 — Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation (CVSS 5.4)
- CVE-2026-3098 — Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll (CVSS 6.5)
- CVE-2025-6348 — Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter (CVSS 4.9)
- CVE-2024-3027 — Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload (CVSS 6.4)
- CVE-2022-45845 — WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection (CVSS 8.8)
- CVE-2023-0660 — Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS (CVSS 5.4)
- CVE-2022-45843 — WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2022-3357 — Smart Slider 3 < 3.5.1.11 - PHP Object Injection (CVSS 8.8)