Known vulnerabilities in Shortcodes and extra features for Phlox theme

Powerful and comprehensive plugin that extends the functionality of Phlox Elementor theme.

20Reported vulnerabilities

9.8Highest CVSS score

2.17.22Latest version

80,000+Active installs

What to do now

Update Shortcodes and extra features for Phlox theme to 2.17.14 or later. 18 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 1, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-37888	Critical 9.8	0.7%	2.14.0 and earlier	`2.15.0`	November 15, 2023
CVE-2023-7064	High 7.5	0.9%	Before 2.17.6	`2.17.6`	May 2, 2024
CVE-2023-50368	Medium 6.4	0.4%	2.15.4 and earlier	`2.15.5`	December 6, 2023
CVE-2026-57737	Medium 6.4	0.2%	2.17.21 and earlier	—	July 1, 2026
CVE-2025-12379	Medium 6.4	0.2%	0 to 2.17.13 (inclusive)	`2.17.14`	January 10, 2026
WF-85551ba1-6d6e-47a0-864f-f9d0a0a11056	Medium 6.4	—	2.9.8 and earlier	`2.9.14`	July 12, 2022
CVE-2024-9545	Medium 5.4	0.3%	Before 2.17.1	`2.17.1`	December 21, 2024
CVE-2024-12588	Medium 5.4	0.3%	Before 2.17.3	`2.17.3`	December 21, 2024
CVE-2024-8486	Medium 5.4	0.4%	Before 2.16.4	`2.16.4`	October 5, 2024
CVE-2024-3517	Medium 5.4	0.5%	Before 2.15.6	`2.15.6`	May 2, 2024
CVE-2024-3341	Medium 5.4	0.5%	Before 2.15.8	`2.15.8`	May 2, 2024
CVE-2024-1533	Medium 5.4	0.4%	Before 2.15.8	`2.15.8`	May 2, 2024
CVE-2024-1396	Medium 5.4	0.4%	Before 2.15.8	`2.15.8`	May 2, 2024
CVE-2024-1348	Medium 5.4	0.4%	Before 2.15.6	`2.15.6`	May 2, 2024
CVE-2024-1357	Medium 5.4	0.4%	Before 2.15.8	`2.15.8`	April 16, 2024
CVE-2025-13215	Medium 5.3	0.2%	0 to 2.17.13 (inclusive)	`2.17.14`	January 6, 2026
CVE-2025-63071	Medium 5.3	0.3%	2.17.13 and earlier	`2.17.14`	October 26, 2025
CVE-2025-69016	Medium 4.3	0.2%	2.17.14 and earlier	—	December 27, 2025
CVE-2024-50500	Medium 4.3	0.4%	2.17.4 and earlier	`2.17.5`	January 31, 2025
CVE-2024-31099	Medium 4.3	0.4%	2.15.5 and earlier	`2.15.8`	March 29, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.