Nextendweb
15 CVEs across 12 Nextendweb products. Browse Nextendweb vulnerabilities, severities, and proof-of-concept exploits.
Nextendweb products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12385 | Medium | 4.3 | 2026-07-13 | The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parame… |
CVE-2026-9197 | Medium | 4.9 | 2026-06-06 | The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function… |
CVE-2026-34424 | Critical | 9.8 | 2026-04-09 | Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that all… |
CVE-2026-4065 | Medium | 5.4 | 2026-04-07 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smar… |
CVE-2026-3098 | Medium | 6.5 | 2026-03-27 | The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function… |
CVE-2025-13737 | Medium | 4.3 | 2025-11-28 | The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is du… |
CVE-2025-58031 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-con… |
CVE-2025-6348 | Medium | 4.9 | 2025-07-30 | The Smart Slider 3 plugin for WordPress is vulnerable to time-based SQL Injection via the ‘sliderid’ parameter in all versions up to, and including, 3.5.1.28 d… |
CVE-2025-1061 | Critical | 9.8 | 2025-02-07 | The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient… |
CVE-2024-9893 | Critical | 9.8 | 2024-10-16 | The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insuffici… |
CVE-2024-3027 | Medium | 6.4 | 2024-04-13 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all vers… |
CVE-2024-1775 | Medium | 5.4 | 2024-03-02 | The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter i… |
CVE-2022-45845 | Medium | 4.3 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9. |
CVE-2023-0660 | Medium | 5.4 | 2023-03-27 | The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a pag… |
CVE-2022-45843 | Medium | 5.4 | 2023-03-23 | Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions. |
CVE-2022-3357 | High | 8.8 | 2022-10-31 | The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user i… |
CVE-2021-24382 | Medium | 5.4 | 2021-06-14 | The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored C… |
CVE-2015-4557 | Medium | 6.1 | 2018-04-12 | Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1… |
CVE-2015-4413 | | 2015-06-24 | Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for… | |
CVE-2014-8800 | | 2014-12-05 | Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attac… |