https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63045.htmlhttps://patchthecve.com/cve/CVE-2025-63045.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider Pro masterslider allows DOM-Based XSS.This issue affects Master Slider Pro: from n/a through <= 3.7.12.https://patchthecve.com/cve/CVE-2025-58025.htmlhttps://patchthecve.com/cve/CVE-2025-58025.htmlSun, 11 Oct 2026 21:10:00 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This issue affects Master Slider: from n/a through <= 3.11.0.https://patchthecve.com/cve/CVE-2025-5291.htmlhttps://patchthecve.com/cve/CVE-2025-5291.htmlWed, 17 Jun 2026 09:47:37 +0000MEDIUM 6.4: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. https://patchthecve.com/cve/CVE-2025-39412.htmlhttps://patchthecve.com/cve/CVE-2025-39412.htmlWed, 17 Jun 2026 09:17:54 +0000MEDIUM 4.3: Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.https://patchthecve.com/cve/CVE-2024-13757.htmlhttps://patchthecve.com/cve/CVE-2024-13757.htmlWed, 17 Jun 2026 07:02:40 +0000MEDIUM 6.4: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possiblhttps://patchthecve.com/cve/CVE-2024-11731.htmlhttps://patchthecve.com/cve/CVE-2024-11731.htmlWed, 17 Jun 2026 06:58:20 +0000MEDIUM 6.4: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibhttps://patchthecve.com/cve/CVE-2024-50500.htmlhttps://patchthecve.com/cve/CVE-2024-50500.htmlWed, 17 Jun 2026 08:04:35 +0000MEDIUM 4.3: Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.4.https://patchthecve.com/cve/CVE-2022-47176.htmlhttps://patchthecve.com/cve/CVE-2022-47176.htmlWed, 17 Jun 2026 05:13:12 +0000MEDIUM 4.3: Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.https://patchthecve.com/cve/CVE-2024-47381.htmlhttps://patchthecve.com/cve/CVE-2024-47381.htmlWed, 17 Jun 2026 07:56:58 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Depicter Slider depicter allows Stored XSS.This issue affects Depicter Slider: from n/a through <= 3.2.2.https://patchthecve.com/cve/CVE-2024-8486.htmlhttps://patchthecve.com/cve/CVE-2024-8486.htmlWed, 17 Jun 2026 08:22:43 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in the Modern Heading and Icon Picker widgets all versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes ihttps://patchthecve.com/cve/CVE-2024-1384.htmlhttps://patchthecve.com/cve/CVE-2024-1384.htmlWed, 17 Jun 2026 07:04:06 +0000MEDIUM 6.4: The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_recent_portfolios_grid' shortcode in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping on user supplied attributes.https://patchthecve.com/cve/CVE-2024-6339.htmlhttps://patchthecve.com/cve/CVE-2024-6339.htmlWed, 17 Jun 2026 08:17:48 +0000MEDIUM 6.1: The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in paghttps://patchthecve.com/cve/CVE-2024-43161.htmlhttps://patchthecve.com/cve/CVE-2024-43161.htmlWed, 17 Jun 2026 07:50:32 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.1.2.https://patchthecve.com/cve/CVE-2024-6490.htmlhttps://patchthecve.com/cve/CVE-2024-6490.htmlWed, 17 Jun 2026 08:18:06 +0000MEDIUM 6.5: During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.https://patchthecve.com/cve/CVE-2024-3587.htmlhttps://patchthecve.com/cve/CVE-2024-3587.htmlWed, 17 Jun 2026 07:44:34 +0000MEDIUM 6.4: The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it phttps://patchthecve.com/cve/CVE-2024-37222.htmlhttps://patchthecve.com/cve/CVE-2024-37222.htmlWed, 17 Jun 2026 07:37:57 +0000HIGH 7.1: Cross Site Scripting (XSS) vulnerability in Averta Master Slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.10.0.https://patchthecve.com/cve/CVE-2023-50900.htmlhttps://patchthecve.com/cve/CVE-2023-50900.htmlWed, 17 Jun 2026 06:40:11 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10.https://patchthecve.com/cve/CVE-2024-4375.htmlhttps://patchthecve.com/cve/CVE-2024-4375.htmlWed, 17 Jun 2026 08:01:46 +0000MEDIUM 6.4: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'css_id' user supplied attribute. This mahttps://patchthecve.com/cve/CVE-2023-6382.htmlhttps://patchthecve.com/cve/CVE-2023-6382.htmlWed, 17 Jun 2026 06:50:39 +0000MEDIUM 6.4: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'css_class' attribute. This makehttps://patchthecve.com/cve/CVE-2024-4470.htmlhttps://patchthecve.com/cve/CVE-2024-4470.htmlWed, 17 Jun 2026 08:01:56 +0000MEDIUM 6.4: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide_info' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'tag_name' attribute. This https://patchthecve.com/cve/CVE-2023-37888.htmlhttps://patchthecve.com/cve/CVE-2023-37888.htmlWed, 17 Jun 2026 06:08:50 +0000HIGH 7.6: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0.https://patchthecve.com/cve/CVE-2024-3517.htmlhttps://patchthecve.com/cve/CVE-2024-3517.htmlWed, 17 Jun 2026 07:44:25 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wihttps://patchthecve.com/cve/CVE-2024-3341.htmlhttps://patchthecve.com/cve/CVE-2024-3341.htmlWed, 17 Jun 2026 07:43:48 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_gmaps' shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ihttps://patchthecve.com/cve/CVE-2024-1533.htmlhttps://patchthecve.com/cve/CVE-2024-1533.htmlWed, 17 Jun 2026 07:04:26 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with chttps://patchthecve.com/cve/CVE-2024-1396.htmlhttps://patchthecve.com/cve/CVE-2024-1396.htmlWed, 17 Jun 2026 07:04:08 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackerhttps://patchthecve.com/cve/CVE-2024-1348.htmlhttps://patchthecve.com/cve/CVE-2024-1348.htmlWed, 17 Jun 2026 07:04:02 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,https://patchthecve.com/cve/CVE-2023-7064.htmlhttps://patchthecve.com/cve/CVE-2023-7064.htmlWed, 17 Jun 2026 06:51:59 +0000HIGH 7.5: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxin_template_control_importer' function. This makes it possiblhttps://patchthecve.com/cve/CVE-2024-32600.htmlhttps://patchthecve.com/cve/CVE-2024-32600.htmlWed, 17 Jun 2026 07:29:55 +0000HIGH 8.3: Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5.https://patchthecve.com/cve/CVE-2024-32580.htmlhttps://patchthecve.com/cve/CVE-2024-32580.htmlWed, 17 Jun 2026 07:29:53 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows Stored XSS.This issue affects Master Slider: from n/a through 3.9.8.https://patchthecve.com/cve/CVE-2024-1357.htmlhttps://patchthecve.com/cve/CVE-2024-1357.htmlWed, 17 Jun 2026 07:04:03 +0000MEDIUM 6.4: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as thumhttps://patchthecve.com/cve/CVE-2024-31099.htmlhttps://patchthecve.com/cve/CVE-2024-31099.htmlWed, 17 Jun 2026 07:27:47 +0000MEDIUM 6.4: Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme auxin-elements.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.7.