CVE-2026-57737
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
DOM-Based XSS vulnerability in the Shortcodes and extra features for Phlox theme plugin by Averta LTD. Improper input neutralization during page generation allows execution of malicious scripts in the victim's browser.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser context, potentially leading to data theft, session hijacking, or content modification.
Recommendation
Update the Shortcodes and extra features for Phlox theme plugin to a version newer than 2.17.22 if a patch is available. Additionally, consider implementing Content Security Policy (CSP).
Other vulnerabilities in Shortcodes and extra features for Phlox theme
See all- CVE-2026-74008Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
- CVE-2025-69016Medium
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortcodes and extra features for Phlox theme from n/a through 2.17.22.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows DOM-Based XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS