Log in Start free

Nextendweb

Products

ProductCVEsExploitedLatest
Smart Slider 38–Sep 30, 2026
Nextend Social Login and Register2–Nov 28, 2025
Nextend Social Login Pro2–Feb 7, 2025
Nextend Facebook Connect1–Sep 22, 2025
Smart Slider 3 Pro for Joomla1–Apr 9, 2026
Smart Slider 3 Pro for WordPress1–Apr 9, 2026

Exploited and recent CVEs

  • CVE-2026-14876 Medium 6.4 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block 0.2%
  • CVE-2026-15798 Medium 6.4 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute 0.4%
  • CVE-2026-12385 Medium 4.3 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter 0.4%
  • CVE-2026-9197 Medium 4.9 Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export 0.6%
  • CVE-2026-34424 Critical 9.8 Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit 0.6%
  • CVE-2026-34424 Critical 9.8 Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit 0.6%
  • CVE-2026-4065 Medium 5.4 Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation 0.4%
  • CVE-2026-3098 Medium 6.5 Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll 0.5%
  • CVE-2025-13737 Medium 4.3 Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login 0.2%
  • CVE-2025-58031 Medium 6.5 WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2025-6348 Medium 4.9 Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter 0.4%
  • CVE-2025-1061 Critical 9.8 Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider 0.7%
  • CVE-2024-9893 Critical 9.8 Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider 0.7%
  • CVE-2024-3027 Medium 6.4 Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload 0.3%
  • CVE-2024-1775 Medium 5.4 Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description 0.4%