Which versions of Shortcodes and extra features for Phlox theme are vulnerable?

Known issues on record (newest first): Information disclosure (2.17.24 and older); Cross-site scripting (XSS) (2.17.22 and older, fixed in 2.17.24); Stored cross-site scripting (XSS) (2.17.13 and older, fixed in 2.17.14); Information disclosure (2.17.13 and older, fixed in 2.17.14); Missing authorization check (2.17.22 and older, fixed in 2.17.24); Information disclosure (2.17.15 and older, fixed in 2.17.16). The full list with sources is on this page.

What is the latest version of Shortcodes and extra features for Phlox theme?

2.17.24, according to wordpress.org (last updated 2026-10-07). It has 80,000+ active installs.

What should I do if my Shortcodes and extra features for Phlox theme is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update auxin-elements). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · auxin-elements · data as of 2026-11-04

Is Shortcodes and extra features for Phlox theme safe? Known vulnerabilities and latest version

Q: Is Shortcodes and extra features for Phlox theme safe to use?

Laskyr does not give safety verdicts. The latest version (2.17.24) has 1 known unpatched vulnerability. As of 2026-11-04, the sources we check list the newest release of Shortcodes and extra features for Phlox theme as affected and name no fixed version yet. Keep Shortcodes and extra features for Phlox theme on the latest version (2.17.24) and remove it if you do not use it.

Latest version: 2.17.24
Last updated: 2026-10-07
Active installs: 80,000+
Known issues on record: 22
Unpatched in latest: 1
Tested up to WP: 7.1.4 · PHP 7.0+

Powerful and comprehensive plugin that extends the functionality of Phlox Elementor theme. — by averta

What to do

There is no fixed version yet. If you can live without Shortcodes and extra features for Phlox theme for now, deactivate it and delete it until the developer ships a fix.
If you must keep it, limit who can log in (remove unused accounts, especially low-level ones) and put a web application firewall in front of the site.
Watch for an update: get an email when this page changes.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan, or have us clean it: Emergency Cleanup, $499.

With WP-CLI: wp plugin get auxin-elements --field=version shows what you run; wp plugin update auxin-elements updates it.

Check your version

Known vulnerabilities

22 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 5.3 affects latest 2.17.24 CVE-2026-74008 · published 2026-08-18

Information disclosure in Shortcodes and extra features for Phlox theme (2.17.24 and older)

Affected: 2.17.24 and older
Fixed in: no fix listed yet
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.

NVD CVE-2026-74008 Patchstack advisory

medium 6.5 CVE-2026-57737 · published 2026-07-01

Cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.22 and older)

Affected: 2.17.22 and older
Fixed in: 2.17.24
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows DOM-Based XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

NVD CVE-2026-57737 Patchstack advisory

medium 6.4 CVE-2025-12379 · published 2026-01-10

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.13 and older)

Affected: 2.17.13 and older
Fixed in: 2.17.14 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a combination of the 'tag' and ‘title_tag’ parameters in all versions up to, and including, 2.17.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-12379 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2025-13215 · published 2026-01-06

Information disclosure in Shortcodes and extra features for Phlox theme (2.17.13 and older)

Affected: 2.17.13 and older
Fixed in: 2.17.14 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via the auxels_ajax_search due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract titles of draft posts that they should not have access to.

NVD CVE-2025-13215 Wordfence advisory Plugin source

medium 4.3 CVE-2025-69016 · published 2025-12-30

Missing authorization check in Shortcodes and extra features for Phlox theme (2.17.22 and older)

Affected: 2.17.22 and older
Fixed in: 2.17.24
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

NVD CVE-2025-69016 Patchstack advisory

medium 5.3 CVE-2025-63071 · published 2025-12-09

Information disclosure in Shortcodes and extra features for Phlox theme (2.17.15 and older)

Affected: 2.17.15 and older
Fixed in: 2.17.16 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Insertion of Sensitive Information Into Sent Data vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.15.

NVD CVE-2025-63071 Patchstack advisory

critical 9.8 CVE-2024-50500 · published 2025-02-03

Missing authorization check in Shortcodes and extra features for Phlox theme (2.17.4 and older)

Affected: 2.17.4 and older
Fixed in: 2.17.5
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.4.

NVD CVE-2024-50500 Patchstack advisory

medium 5.4 CVE-2024-12588 · published 2024-12-21

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.2 and older)

Affected: 2.17.2 and older
Fixed in: 2.17.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-12588 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-9545 · published 2024-12-21

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.0 and older)

Affected: 2.17.0 and older
Fixed in: 2.17.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_contact_box and aux_gmaps shortcodes in all versions up to, and including, 2.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-9545 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-8486 · published 2024-10-05

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.16.3 and older)

Affected: 2.16.3 and older
Fixed in: 2.16.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in the Modern Heading and Icon Picker widgets all versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-8486 Wordfence advisory Code change (fix)Plugin source

critical 9.8 CVE-2023-37888 · published 2024-05-17

File inclusion in Shortcodes and extra features for Phlox theme (2.14.0 and older)

Affected: 2.14.0 and older
Fixed in: 2.15.0
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0.

NVD CVE-2023-37888 Patchstack advisory

medium 5.4 CVE-2024-3517 · published 2024-05-02

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.5 and older)

Affected: 2.15.5 and older
Fixed in: 2.15.6 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3517 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-3341 · published 2024-05-02

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Affected: 2.15.7 and older
Fixed in: 2.15.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_gmaps' shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3341 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-1533 · published 2024-05-02

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Affected: 2.15.7 and older
Fixed in: 2.15.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Requires Elementor and the Phlox theme to be installed.

NVD CVE-2024-1533 Wordfence advisory Code change (fix)wordpress.org

medium 5.4 CVE-2024-1348 · published 2024-05-02

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Affected: 2.15.7 and older
Fixed in: 2.15.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1348 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-1396 · published 2024-05-02

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Affected: 2.15.7 and older
Fixed in: 2.15.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1396 Wordfence advisory Code change (fix)Plugin source

high 7.5 CVE-2023-7064 · published 2024-05-02

PHP object injection in Shortcodes and extra features for Phlox theme (2.17.5 and older)

Affected: 2.17.5 and older
Fixed in: 2.17.6 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxin_template_control_importer' function. This makes it possible for authenticated attackers able to upload a separate PHAR payload as an image file to inject a PHP Object, though the action itself is available to subscribers. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

NVD CVE-2023-7064 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2024-1357 · published 2024-04-16

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Affected: 2.15.7 and older
Fixed in: 2.15.8 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as thumb_mode and date_type. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1357 Wordfence advisory Code change (fix)Plugin source

high 8.8 CVE-2024-31099 · published 2024-04-01

Missing authorization check in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Affected: 2.15.7 and older
Fixed in: 2.15.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme auxin-elements.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.7.

NVD CVE-2024-31099 Patchstack advisory

medium 5.4 CVE-2023-50368 · published 2023-12-14

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.2 and older)

Affected: 2.15.2 and older
Fixed in: 2.15.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allows Stored XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.2.

NVD CVE-2023-50368 Patchstack advisory

high 8.8 CVE-2022-3359 · published 2022-12-12

PHP object injection in Shortcodes and extra features for Phlox theme (older than 2.10.7)

Affected: older than 2.10.7
Fixed in: 2.10.7
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

NVD CVE-2022-3359 WPScan advisory

medium 6.1 CVE-2022-1910 · published 2022-07-11

Reflected cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (older than 2.9.8)

Affected: older than 2.9.8
Fixed in: 2.9.8
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

NVD CVE-2022-1910 WPScan advisory

Recent activity

2026-10-07 — latest release on wordpress.org (2.17.24).
2026-08-18 — Information disclosure disclosed (CVE-2026-74008), no fix listed yet.
2026-07-01 — Cross-site scripting (XSS) disclosed (CVE-2026-57737), fixed in 2.17.24.
2026-01-10 — Stored cross-site scripting (XSS) disclosed (CVE-2025-12379), fixed in 2.17.14.

Free. We check the CVE feeds every day and email you only when a new issue for Shortcodes and extra features for Phlox theme (auxin-elements) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (13) · Sensitive data exposure (3) · Missing authorization (3) · PHP object injection (2) · File inclusion (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/auxin-elements (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/auxin-elements"><img src="https://laskyr.com/plugins/auxin-elements/badge.svg" alt="Shortcodes and extra features for Phlox theme vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Shortcodes and extra features for Phlox theme safe? Known vulnerabilities and latest version

The latest version (2.17.24) has 1 known unpatched vulnerability

What to do

Check your version

Known vulnerabilities

Information disclosure in Shortcodes and extra features for Phlox theme (2.17.24 and older)

Cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.22 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.13 and older)

Information disclosure in Shortcodes and extra features for Phlox theme (2.17.13 and older)

Missing authorization check in Shortcodes and extra features for Phlox theme (2.17.22 and older)

Information disclosure in Shortcodes and extra features for Phlox theme (2.17.15 and older)

Missing authorization check in Shortcodes and extra features for Phlox theme (2.17.4 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.2 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.17.0 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.16.3 and older)

File inclusion in Shortcodes and extra features for Phlox theme (2.14.0 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.5 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

PHP object injection in Shortcodes and extra features for Phlox theme (2.17.5 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Missing authorization check in Shortcodes and extra features for Phlox theme (2.15.7 and older)

Stored cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (2.15.2 and older)

PHP object injection in Shortcodes and extra features for Phlox theme (older than 2.10.7)

Reflected cross-site scripting (XSS) in Shortcodes and extra features for Phlox theme (older than 2.9.8)

Recent activity

Get an email when Shortcodes and extra features for Phlox theme has a new vulnerability

Browse vulnerabilities

Where this data comes from