CVE-2025-69016
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortcodes and extra features for Phlox theme from n/a through 2.17.22.
Risk Assessment
An unauthorized person may gain access to administrative functions of the plugin, potentially leading to unauthorized changes and system integrity compromise.
Recommendation
Update the auxin-elements plugin to a version newer than 2.17.22 and review access control configuration.
Other vulnerabilities in Shortcodes and extra features for Phlox theme
See all- CVE-2026-74008Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
- CVE-2026-57737Medium
DOM-Based XSS vulnerability in the Shortcodes and extra features for Phlox theme plugin by Averta LTD. Improper input neutralization during page generation allows execution of malicious scripts in the victim's browser.
Original NVD description (English source)
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS