Skip to content
OpenAdvisories

Vendor

Averta

60 known vulnerabilities.

Products

Shortcodes and extra features for Phlox theme 19 Master Slider – Responsive Touch Slider 9 Depicter — Popup & Slider Builder 8 Master Slider 8 Depicter Slider 7 Premium Portfolio Features for Phlox theme 3 Master Slider Pro 2 Phlox Portfolio 1 Phlox PRO 1 Phlox Shop 1 Phlox 1
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.5
    CVE-2026-66622

    WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

    Averta Depicter Slider
  • High 7.1
    CVE-2026-56014

    WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.

    Averta Master Slider
  • High 8.1
    CVE-2025-12497

    Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]

    The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to inclu…

    Averta Premium Portfolio Features for Phlox theme Web / CMS
  • High 7.5
    CVE-2025-2011 Public exploit EPSS 47%

    Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter

    The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…

    Averta Depicter — Popup & Slider Builder Web / CMS
  • High 8.8
    CVE-2024-4389

    Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload

    The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attack…

    Averta Depicter — Popup & Slider Builder Web / CMS
  • High 7.1
    CVE-2024-37222

    WordPress Master Slider plugin <= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Cross Site Scripting (XSS) vulnerability in Averta Master Slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.10.0.

    Averta Master Slider
  • High 8.6
    CVE-2023-39163

    WordPress Phlox Shop plugin <= 2.0.0 - Unauthenticated Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.

    Averta Phlox Shop
  • High 8.6
    CVE-2023-38399

    WordPress Phlox Portfolio plugin <= 2.3.1 - Unauthenticated Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1.

    Averta Phlox Portfolio
  • High 7.5
    CVE-2023-7064

    Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

    The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxin_template_control_…

    Averta Shortcodes and extra features for Phlox theme Web / CMS
  • High 8.3
    CVE-2024-32600

    WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5.

    Averta Master Slider
  • High 7.1
    CVE-2023-47508

    WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Averta Master Slider Pro plugin <= 3.6.5 versions.

    Averta Master Slider Pro