Shortcodes and extra features for Phlox theme

Shortcodes and extra features for Phlox theme has 23 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 20 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2024 was the busiest year with 11 disclosures.

The most common weakness is Cross-Site Scripting, behind 14 of the records (61%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.

20 of the records (87%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2025.

17 independent researchers contributed these findings, most of them (3) reported by Ngô Thiên An (ancorn_). Shortcodes and extra features for Phlox theme is installed on roughly 80,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage87%

Open

Fixed

Get automatic notifications for all Shortcodes and extra features for Phlox theme vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-57737

Shortcodes and extra features for Phlox theme <= 2.17.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

23 records


2026-08-17 17:10	Shortcodes and extra features for Phlox theme <= 2.17.22 - Unauthenticated Information Exposure Shortcodes and extra features… <= 2.17.22	`CVE-2026-74008`	5.3 Medium	Ananda Dhakal	No
2026-07-01 00:00	Shortcodes and extra features for Phlox theme <= 2.17.21 - Authenticated (Contributor+) Stored Cross-Site Scripting Shortcodes and extra features… <= 2.17.21	`CVE-2026-57737`	6.4 Medium	timomangcut	No
2026-01-09 00:00	Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget Shortcodes and extra features… <= 2.17.13	`CVE-2025-12379`	6.4 Medium	Abu Hurayra (HurayraIIT)	Yes
2026-01-05 17:46	Shortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure Shortcodes and extra features… <= 2.17.13	`CVE-2025-13215`	5.3 Medium	Nguyen C	Yes
2025-12-27 00:00	Shortcodes and extra features for Phlox <= 2.17.14 - Missing Authorization Shortcodes and extra features… <= 2.17.14	`CVE-2025-69016`	4.3 Medium	Legion Hunter	No
2025-10-26 00:00	Shortcodes and extra features for Phlox <= 2.17.13 - Unauthenticated Information Exposure Shortcodes and extra features… <= 2.17.13	`CVE-2025-63071`	5.3 Medium	Bao - BlueRock	Yes
2025-01-31 00:00	Shortcodes and extra features for Phlox theme <= 2.17.4 - Missing Authorization Shortcodes and extra features… <= 2.17.4	`CVE-2024-50500`	4.3 Medium	Rafie Muhammad	Yes
2024-12-20 20:19	Shortcodes and extra features for Phlox theme <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget Shortcodes and extra features… <= 2.17.2	`CVE-2024-12588`	6.4 Medium	zer0gh0st	Yes
2024-12-20 20:19	Shortcodes and extra features for Phlox theme <= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodes Shortcodes and extra features… <= 2.17.0	`CVE-2024-9545`	6.4 Medium	David Gallagher (BatFeats)	Yes
2024-10-04 00:00	Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets Shortcodes and extra features… <= 2.16.3	`CVE-2024-8486`	6.4 Medium	Webbernaut	Yes

Showing 1–10 of 23 reports

Latestv2.17.22

Shortcodes and extra features for Phlox theme

Author

averta

2.1(7)

42/100

Last Updated

2026-08-01 (1mo ago)

Active Installs

80,000+

Downloads

3,432,243

Requires WP

5.0+

Requires PHP

7.0+

Tested up to

WP 7.0.4

Created

2016-08-30 (10y ago)

Overview This plugin adds plenty of premium functionalities to Phlox theme, such as one-click demo importer, plugin manager, new shortcodes, widgets, page builder elements as well as extra theme options to extend the functionality of that theme. Demo on Phlox Theme | Documentation | Video tutorials | Support forum Features Elementor Page builder support (27 Exclusive Elements) Page builder Elements 31 Exclusive Shortcodes Auxin Widgets Login page customization Custom CSS and Javascript fields Header layout and image customization Mega Menu Fullscreen Menu Menu Skins Various Blog Page templates Sticky Header Sticky Footer Fully Responsive Cross Browser IE8+ and Other Modern Browsers Some demo sites by Phlox theme Minimal Portfolio Modern Shop Real State The Architect Minimal Photography Journey Blog Classic Blog Portfolio Vivid Classic Portfolio Food Blog Default Coming Soon Red Coming Soon Galaxy Compatible Browsers IE9+ Firefox Safari Opera Chrome iOS browser Android browser Documentations If you have any question about working with “Phlox Core Elements”, you can take a look at online documentations Translation You can start translating this plugin from here: online translation service.

View on WordPress.org