CVE-2026-57737Medium· 6.5▾ Sunlit

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows DOM-Based XSS.This issue affects Shortcodes and extra fe…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 1, 2026

Updated

Oct 7, 2026

CVSS

6.5

Vendor

Averta LTD

Product

auxin-elements

CWE

CWE-79

Depth score

36 · Low

EPSS

0.22% · p12

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

decided 2026-07-02

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 98 days

Jul 1, 2026Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
0.2%

Averta LTD CWE-79 #nvd #cve.org

Affected

auxin-elements <= 2.17.22

Full technical detail▾

Overview

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://patchstack.com/database/wordpress/plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-16-cross-site-scripting-xss-vulnerability?_s_id=cve

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed

CVE-2026-57737Medium· 6.5▾ Sunlit

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows DOM-Based XSS.This issue affects Shortcodes and extra fe…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 1, 2026

Updated

Oct 7, 2026

CVSS

6.5

Vendor

Averta LTD

Product

auxin-elements

CWE

CWE-79

Depth score

36 · Low

EPSS

0.22% · p12

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

decided 2026-07-02

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.