Smart Slider 3

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Smart Slider 3

Information

Software Type Plugin
Software Slug smart-slider-3 (view on wordpress.org)
Software Status Active
Software Author nextendweb
Software Website smartslider3.com
Software Downloads 23,996,403
Software Active Installs 800,000
Software Record Last Updated July 18, 2026

11 Vulnerabilities

Submit a Vulnerability
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
4.3
CVE-2026-12385
Jul 13, 2026
Researcher: Yuvraj Tomar
Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
4.9
CVE-2026-9197
Jun 5, 2026
Researcher: Nguyen Khanh Hao
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
5.4
CVE-2026-4065
Apr 7, 2026
Researcher: normaandersonfrank
Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
6.5
CVE-2026-3098
Mar 26, 2026
Researcher: Dmitrii Ignatyev
Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter
4.9
CVE-2025-6348
Jul 29, 2025
Researcher: Chive
Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload
6.4
CVE-2024-3027
Apr 12, 2024
Researcher: Christiaan Swiers (YouGina)
Smart Slider 3 <= 3.5.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-0660
Feb 28, 2023
Researcher: Erwan LR
Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) PHP Object Injection
8.8
CVE-2022-45845
Nov 23, 2022
Researcher: Dave Jong
Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2022-45843
Nov 23, 2022
Researcher: R3N0
Smart Slider 3 <= 3.5.1.9 - PHP Object Injection
7.2
CVE-2022-3357
Oct 10, 2022
Researcher: Nguyen Duy Quoc Khanh
Smart Slider 3 <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting
5.4
CVE-2021-24382
Jun 7, 2021
Researchers: Hardik Solanki, blackangel
Title Status CVE ID CVSS Researchers Date
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter Patched CVE-2026-12385 4.3 Yuvraj Tomar July 13, 2026
Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export Patched CVE-2026-9197 4.9 Nguyen Khanh Hao June 5, 2026
Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation Patched CVE-2026-4065 5.4 normaandersonfrank April 7, 2026
Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll Patched CVE-2026-3098 6.5 Dmitrii Ignatyev March 26, 2026
Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter Patched CVE-2025-6348 4.9 Chive July 29, 2025
Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload Patched CVE-2024-3027 6.4 Christiaan Swiers (YouGina) April 12, 2024
Smart Slider 3 <= 3.5.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2023-0660 6.4 Erwan LR February 28, 2023
Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2022-45845 8.8 Dave Jong November 23, 2022
Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2022-45843 6.4 R3N0 November 23, 2022
Smart Slider 3 <= 3.5.1.9 - PHP Object Injection Patched CVE-2022-3357 7.2 Nguyen Duy Quoc Khanh October 10, 2022
Smart Slider 3 <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting Patched CVE-2021-24382 5.4 Hardik Solanki, blackangel June 7, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation