Skip to main content

Phlox Theme Plugin EUVDEUVD-2026-41105

| CVE-2026-57737 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-01 Patchstack GHSA-gjh6-v8v4-8hv9
XSS Shortcodes And Extra Features For Phlox Theme
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
5.4 MEDIUM

PR:L reflects required contributor-level WordPress auth; A:N because DOM XSS does not impact service availability; remaining metrics align with network-delivered, scope-changing XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Jul 01, 2026 - 18:25 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme allows DOM-Based XSS.

This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.16.

AnalysisAI

DOM-Based XSS in the Shortcodes and extra features for Phlox theme WordPress plugin (all versions through 2.17.16) permits a low-privileged authenticated attacker to inject malicious JavaScript that executes in victims' browsers via unsanitized shortcode input. Exploitation requires an attacker with at least contributor-level WordPress access and a privileged user to view the crafted page, enabling session hijacking, credential theft, or unauthorized administrative actions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege WordPress contributor account
Delivery
Craft DOM XSS payload within Phlox shortcode attribute
Exploit
Publish or submit post containing malicious shortcode
Execution
Lure privileged user to view affected page
Persist
DOM JavaScript writes unsanitized input to page
Impact
Steal session cookies or perform admin actions as victim
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold an authenticated low-privileged WordPress account with permission to create or edit content using Phlox shortcodes - typically at least Contributor or Author role (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L yields 6.5 Medium. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers or compromises a contributor-level WordPress account on a target site running the Phlox plugin. The attacker creates a post or page embedding a crafted Phlox shortcode whose attribute contains a JavaScript payload that is later processed unsafely by client-side DOM manipulation. …
Remediation Administrators should update the auxin-elements plugin to a version beyond 2.17.16 - the exact patched release version is not independently confirmed in available data and must be verified via the WordPress plugin repository (wordpress.org/plugins/auxin-elements) or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-16-cross-site-scripting-xss-vulnerability before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shortcodes And Extra Features For Phlox Theme

View all
CVE-2022-1910 MEDIUM POC
6.1 Jul 11

The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter befor
CVE-2024-31099 HIGH
8.8 Apr 01

Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme auxin-elements.15.7. Rated h
CVE-2022-3359 HIGH
8.8 Dec 12

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported
CVE-2023-7064 HIGH
7.5 May 02

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all vers
CVE-2023-50368 MEDIUM
6.5 Dec 14

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes

CVE-2024-3341 MEDIUM
6.4 May 02

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2024-3517 MEDIUM
6.4 May 02

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2024-1533 MEDIUM
6.4 May 02

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2024-9545 MEDIUM
6.4 Dec 21

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2024-1348 MEDIUM
6.4 May 02

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2024-1396 MEDIUM
6.4 May 02

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2024-12588 MEDIUM
6.4 Dec 21

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

EUVD-2026-41105 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy