CVE-2025-63071
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Shortcodes and extra features for Phlox theme plugin from averta is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.17.15.
Risk Assessment
An attacker can access sensitive data that is being sent, potentially leading to confidentiality breaches and information leakage.
Recommendation
Update the plugin to the latest patched version. Also check for any data leaks.
Other vulnerabilities in Shortcodes and extra features for Phlox theme
See all- CVE-2026-74008Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
- CVE-2026-57737Medium
DOM-Based XSS vulnerability in the Shortcodes and extra features for Phlox theme plugin by Averta LTD. Improper input neutralization during page generation allows execution of malicious scripts in the victim's browser.
- CVE-2025-69016Medium
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortcodes and extra features for Phlox theme from n/a through 2.17.22.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.15.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS