Smart Slider 3 Security & Risk Analysis

wordpress.org/plugins/smart-slider-3

Responsive slider plugin to create sliders in visual editor easily. Build beautiful image slider, layer slider, video slider, post slider, and more.

800K active installs v3.5.1.32 PHP 7.0+ WP 5.0+ Updated Jan 14, 2026
carousel-slidergalleryimage-slidersliderslideshow
91
A · Safe
CVEs total7
Unpatched0
Last CVEJul 29, 2025
Safety Verdict

Is Smart Slider 3 Safe to Use in 2026?

Generally Safe

Score 91/100

Smart Slider 3 has a strong security track record. Known vulnerabilities have been patched promptly.

7 known CVEsLast CVE: Jul 29, 2025Updated 2mo ago
Risk Assessment

The Smart Slider 3 plugin exhibits a mixed security posture. While it demonstrates good practices in output escaping (94% properly escaped) and the majority of its SQL queries use prepared statements (68%), significant concerns are raised by the large attack surface exposed through AJAX handlers. Specifically, 8 AJAX handlers are present, and alarmingly, all 8 lack authentication checks, creating a substantial avenue for unauthorized actions.

The static analysis also flags the use of the `unserialize` function twice, which can be a vector for deserialization vulnerabilities if not handled with extreme care and input validation. Although no critical taint flows were identified, the presence of `unserialize` in conjunction with unprotected AJAX endpoints warrants caution.

The plugin's vulnerability history is a significant red flag. With a total of 7 known CVEs, including 2 high and 5 medium severity vulnerabilities, it indicates a recurring pattern of security weaknesses. The common vulnerability types like SQL Injection, Improper Authorization, XSS, and Deserialization of Untrusted Data suggest that input sanitization and authorization checks are areas that have historically required improvement. The most recent vulnerability being in 2025 suggests it's either a hypothetical future date or the data is slightly off, but it still points to a history of security issues.

In conclusion, Smart Slider 3 has strengths in areas like output sanitization and prepared SQL statements. However, the critical risk posed by numerous unprotected AJAX endpoints, the presence of the `unserialize` function, and its history of significant vulnerabilities necessitate careful consideration and prompt patching. The lack of authentication on a large number of entry points is a particularly severe weakness.

Key Concerns

  • Unprotected AJAX handlers
  • Use of unserialize function
  • High number of CVEs in history
  • High severity CVEs in history
  • Medium severity CVEs in history
Vulnerabilities
7

Smart Slider 3 Security Vulnerabilities

CVEs by Year

1 CVE in 2021
2021
3 CVEs in 2022
2022
1 CVE in 2023
2023
1 CVE in 2024
2024
1 CVE in 2025
2025
Patched Has unpatched

Severity Breakdown

High
2
Medium
5

7 total CVEs

CVE-2025-6348medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter

Jul 29, 2025 Patched in 3.5.1.29 (1d)
CVE-2024-3027medium · 6.4Improper Authorization

Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload

Apr 12, 2024 Patched in 3.5.1.23 (1d)
CVE-2023-0660medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Smart Slider 3 <= 3.5.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Feb 28, 2023 Patched in 3.5.1.14 (329d)
CVE-2022-45845high · 8.8Deserialization of Untrusted Data

Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) PHP Object Injection

Nov 23, 2022 Patched in 3.5.1.11 (426d)
CVE-2022-45843medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Nov 23, 2022 Patched in 3.5.1.11 (426d)
CVE-2022-3357high · 7.2Deserialization of Untrusted Data

Smart Slider 3 <= 3.5.1.9 - PHP Object Injection

Oct 10, 2022 Patched in 3.5.1.11 (470d)
CVE-2021-24382medium · 5.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Smart Slider 3 <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting

Jun 7, 2021 Patched in 3.5.0.9 (960d)
Code Analysis
Analyzed Mar 16, 2026

Smart Slider 3 Code Analysis

Dangerous Functions
2
Raw SQL Queries
9
19 prepared
Unescaped Output
53
789 escaped
Nonce Checks
2
Capability Checks
12
File Operations
45
External Requests
3
Bundled Libraries
1

Dangerous Functions Found

unserialize$this->backup = unserialize($importData['data']);Nextend\SmartSlider3\BackupSlider\ImportSlider.php:81
unserialize$unserialize_values = unserialize($v);Nextend\SmartSlider3\Generator\WordPress\Posts\GeneratorGroupPosts.php:92

Bundled Libraries

TinyMCE

SQL Query Safety

68% prepared28 total queries

Output Escaping

94% escaped842 total outputs
Attack Surface
8 unprotected

Smart Slider 3 Attack Surface

Entry Points10
Unprotected8

AJAX Handlers 8

authwp_ajax_smart-slider3Nextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:35
authwp_ajax_et_fb_retrieve_builder_dataNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31lt\DiviV31lt.php:26
authwp_ajax_elementor_ajaxNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:43
authwp_ajax_elementor_render_widgetNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:48
authwp_ajax_sek_get_contentNextend\SmartSlider3\Platform\WordPress\Integration\NimbleBuilder\NimbleBuilder.php:14
authwp_ajax_tb_render_element_shortcodeNextend\SmartSlider3\Platform\WordPress\Integration\ThemifyBuilder\ThemifyBuilder.php:24
authwp_ajax_tb_load_module_partialNextend\SmartSlider3\Platform\WordPress\Integration\ThemifyBuilder\ThemifyBuilder.php:31
authwp_ajax_tb_render_elementNextend\SmartSlider3\Platform\WordPress\Integration\ThemifyBuilder\ThemifyBuilder.php:38

Shortcodes 2

[fusion_smartslider3] Nextend\SmartSlider3\Platform\WordPress\Integration\Fusion\FusionElementSmartSlider3.php:20
[smartslider3] Nextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:418
WordPress Hooks 140
filternextend_translationNextend\Framework\Translation\WordPress\WordPressTranslation.php:12
filterwordpress_prepare_outputNextend\Framework\WordPress\AssetInjector.php:48
actionwp_print_scriptsNextend\Framework\WordPress\AssetInjector.php:223
actionadmin_headNextend\Framework\WordPress\AssetInjector.php:234
actioncustomize_controls_print_scriptsNextend\Framework\WordPress\AssetInjector.php:239
filterthe_contentNextend\SmartSlider3\Generator\WordPress\Posts\Sources\PostsCustomPosts.php:519
filterthe_contentNextend\SmartSlider3\Generator\WordPress\Posts\Sources\PostsPosts.php:394
filterthe_contentNextend\SmartSlider3\Generator\WordPress\Posts\Sources\PostsPostsByIDs.php:101
actioninitNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:20
actionadmin_menuNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:25
actionnetwork_admin_menuNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:30
filterplugin_action_linksNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:40
actionsave_postNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:45
actionwp_untrash_postNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:50
actionwpmu_new_blogNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:57
actionwp_insert_siteNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:62
actionadmin_bar_menuNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:72
actionadmin_headNextend\SmartSlider3\Platform\WordPress\Admin\AdminHelper.php:162
filterrun_ngg_resource_managerNextend\SmartSlider3\Platform\WordPress\Compatibility.php:18
filterwpseo_xml_sitemap_post_urlNextend\SmartSlider3\Platform\WordPress\Compatibility.php:57
filterweglot_button_htmlNextend\SmartSlider3\Platform\WordPress\Compatibility.php:86
actionwp_delete_siteNextend\SmartSlider3\Platform\WordPress\HelperInstall.php:20
actiondelete_blogNextend\SmartSlider3\Platform\WordPress\HelperInstall.php:25
actionadmin_initNextend\SmartSlider3\Platform\WordPress\HelperTinyMCE.php:22
filtermce_external_pluginsNextend\SmartSlider3\Platform\WordPress\HelperTinyMCE.php:44
filtermce_buttonsNextend\SmartSlider3\Platform\WordPress\HelperTinyMCE.php:48
actionacf/register_fieldsNextend\SmartSlider3\Platform\WordPress\Integration\ACF\ACF.php:11
actionacf/include_fieldsNextend\SmartSlider3\Platform\WordPress\Integration\ACF\ACF.php:16
actionfl_builder_editing_enabledNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:24
actionfl_builder_editing_enabledNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:28
actionfl_ajax_before_render_new_moduleNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:34
actionfl_ajax_before_render_layoutNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:38
actionfl_ajax_before_render_module_settingsNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:42
actionfl_ajax_before_save_settingsNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:46
actionfl_ajax_before_copy_moduleNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:50
actionfl_builder_before_render_ajax_layoutNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:54
actioninitNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:59
actionfl_builder_control_smart-sliderNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:64
actionfl_ajax_fl_builder_render_new_module_settingsNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:72
actionfl_ajax_fl_builder_saveNextend\SmartSlider3\Platform\WordPress\Integration\BeaverBuilder\BeaverBuilder.php:77
actionet_builder_readyNextend\SmartSlider3\Platform\WordPress\Integration\Divi\Divi.php:15
actiondivi_extensions_initNextend\SmartSlider3\Platform\WordPress\Integration\Divi\Divi.php:20
actionet_fb_framework_loadedNextend\SmartSlider3\Platform\WordPress\Integration\Divi\Divi.php:25
actionadmin_enqueue_scriptsNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31ge\DiviExtensionSmartSlider3.php:27
actionsmartslider3_slider_changedNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31ge\DiviExtensionSmartSlider3.php:32
filterjs_escapeNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31ge\includes\modules\SmartSlider3\SmartSlider3.php:41
actionwp_footerNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31ge\includes\modules\SmartSlider3\SmartSlider3.php:55
actionadmin_footerNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31lt\DiviModuleSmartSlider.php:31
filteret_builder_get_child_modulesNextend\SmartSlider3\Platform\WordPress\Integration\Divi\V31lt\DiviV31lt.php:13
actionelementor/initNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:16
filterelementor/widgets/black_listNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:25
actiontemplate_redirectNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:33
actionadmin_action_elementorNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:38
actionelementor/widgets/registerNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:55
actionelementor/controls/registerNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:60
actionelementor/widgets/widgets_registeredNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:65
actionelementor/controls/controls_registeredNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:70
actionelementor/editor/before_enqueue_stylesNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:76
actionelementor/editor/before_enqueue_scriptsNextend\SmartSlider3\Platform\WordPress\Integration\Elementor\Elementor.php:81
actionfusion_builder_shortcodes_initNextend\SmartSlider3\Platform\WordPress\Integration\Fusion\Fusion.php:10
actionfusion_builder_before_initNextend\SmartSlider3\Platform\WordPress\Integration\Fusion\Fusion.php:20
filterfusion_builder_fieldsNextend\SmartSlider3\Platform\WordPress\Integration\Fusion\Fusion.php:25
actionfusion_load_moduleNextend\SmartSlider3\Platform\WordPress\Integration\Fusion\FusionElementSmartSlider3.php:15
actioninitNextend\SmartSlider3\Platform\WordPress\Integration\Gutenberg\Gutenberg.php:18
actionenqueue_block_editor_assetsNextend\SmartSlider3\Platform\WordPress\Integration\Gutenberg\Gutenberg.php:47
filterkses_allowed_protocolsNextend\SmartSlider3\Platform\WordPress\Integration\Jetpack\Jetpack.php:21
filterjetpack_photon_skip_imageNextend\SmartSlider3\Platform\WordPress\Integration\Jetpack\Jetpack.php:30
actionadmin_enqueue_scriptsNextend\SmartSlider3\Platform\WordPress\Integration\RankMath\RankMath.php:24
filterpre_do_shortcode_tagNextend\SmartSlider3\Platform\WordPress\Integration\TablePress\TablePress.php:21
filterdo_shortcode_tagNextend\SmartSlider3\Platform\WordPress\Integration\TablePress\TablePress.php:25
actionthemify_builder_setup_modulesNextend\SmartSlider3\Platform\WordPress\Integration\ThemifyBuilder\ThemifyBuilder.php:12
actionfw_option_types_initNextend\SmartSlider3\Platform\WordPress\Integration\Unyson\smartslider\class-fw-extension-smartslider.php:9
filterfw_extensions_locationsNextend\SmartSlider3\Platform\WordPress\Integration\Unyson\Unyson.php:10
actionvc_after_set_modeNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:15
actionvc_frontend_editor_renderNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:24
actionvc_front_load_page_Nextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:29
actionvc_load_shortcodeNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:34
actionvc_load_shortcodeNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:39
actionvc_before_init_baseNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:45
filterthe_excerptNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:52
filterthe_excerptNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:57
actionadmin_footerNextend\SmartSlider3\Platform\WordPress\Integration\VisualComposer1\VisualComposer1.php:97
actioninitNextend\SmartSlider3\Platform\WordPress\Integration\WPRocket\WPRocket.php:16
filterrocket_excluded_inline_js_contentNextend\SmartSlider3\Platform\WordPress\Integration\WPRocket\WPRocket.php:30
filterrocket_defer_inline_exclusionsNextend\SmartSlider3\Platform\WordPress\Integration\WPRocket\WPRocket.php:38
filterrocket_delay_js_exclusionsNextend\SmartSlider3\Platform\WordPress\Integration\WPRocket\WPRocket.php:46
actionwp_headNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:42
actionwp_headNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:47
actionbefore_theme_builder_template_renderNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:56
actionwoocommerce_shop_loopNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:61
actionwoocommerce_shop_loopNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:65
actionwoocommerce_single_product_summaryNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:70
actionwoocommerce_single_product_summaryNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:74
actiondo_feed_rdfNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:82
actiondo_feed_rssNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:86
actiondo_feed_rss2Nextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:90
actiondo_feed_atomNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:94
filterlayf_content_feedNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:103
actionrest_api_initNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:112
actionwpNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:120
actiontemplate_redirectNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:131
actionwp_headNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:133
actionweeblramp_initNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:153
actionpre_amp_render_postNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:164
actionafter_setup_themeNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:171
actionwpNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:177
actionwpNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:181
filterrender_block_nextend/smartslider3Nextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:202
actionwp_enqueue_scriptsNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:431
actionwp_enqueue_scriptsNextend\SmartSlider3\Platform\WordPress\Shortcode\Shortcode.php:435
actionadmin_headNextend\SmartSlider3\Platform\WordPress\SmartSlider3PlatformWordPress.php:52
actionwidgets_initNextend\SmartSlider3\Platform\WordPress\Widget\WidgetHelper.php:13
actionwidgets_admin_pageNextend\SmartSlider3\Platform\WordPress\Widget\WidgetHelper.php:22
actiondynamic_sidebar_beforeNextend\SmartSlider3\Platform\WordPress\Widget\WidgetHelper.php:57
filterwidget_types_to_hide_from_legacy_widget_blockNextend\SmartSlider3\Platform\WordPress\Widget\WidgetSmartSlider3.php:24
actionwpseo_headNextend\SmartSlider3\Platform\WordPress\Widget\WidgetSmartSlider3.php:32
actionwpseo_headNextend\SmartSlider3\Platform\WordPress\Widget\WidgetSmartSlider3.php:36
actioninitNextend\SmartSlider3\Platform\WordPress\WordPressFrontend.php:16
actionadmin_menuNextend\WordPress\Fail.php:8
actioninitNextend\WordPress\OutputBuffer.php:19
actionshutdownNextend\WordPress\OutputBuffer.php:24
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:34
filtercache_bufferNextend\WordPress\OutputBuffer.php:47
filtersbp_output_bufferNextend\WordPress\OutputBuffer.php:58
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:68
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:80
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:92
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:104
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:116
actiontemplate_redirectNextend\WordPress\OutputBuffer.php:135
filtertemplate_includeNextend\WordPress\OutputBuffer.php:145
actionpp_end_htmlNextend\WordPress\OutputBuffer.php:153
actionheadway_html_closeNextend\WordPress\OutputBuffer.php:158
filterautoptimize_filter_html_before_minifyNextend\WordPress\OutputBuffer.php:182
filterrocket_bufferNextend\WordPress\OutputBuffer.php:189
filtergantry_before_render_outputNextend\WordPress\OutputBuffer.php:200
actionplugins_loadedplugin.php:6
actionadmin_noticessmart-slider-3.php:22
actionadmin_noticessmart-slider-3.php:27
actionadmin_noticessmart-slider-3.php:32
Maintenance & Trust

Smart Slider 3 Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedJan 14, 2026
PHP min version7.0
Downloads22.6M

Community Trust

Rating98/100
Number of ratings1,118
Active installs800K
Developer Profile

Smart Slider 3 Developer Profile

Nextendweb

2 plugins · 1.0M total installs

72
trust score
Avg Security Score
90/100
Avg Patch Time
947 days
View full developer profile
Detection Fingerprints

How We Detect Smart Slider 3

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/smart-slider-3/Nextend/Framework/Asset/Predefined.php/wp-content/plugins/smart-slider-3/Nextend/SmartSlider3/Application/Frontend/ApplicationTypeFrontend.php/wp-content/plugins/smart-slider-3/Nextend/SmartSlider3/Platform/WordPress/Admin/AdminHelper.php
Script Paths
/wp-content/plugins/smart-slider-3/Nextend/SmartSlider3/Application/Frontend/ApplicationTypeFrontend.php
Version Parameters
smart-slider-3/style.css?ver=smart-slider-3/nextend/dist/n2.min.css?ver=

HTML / DOM Fingerprints

CSS Classes
smart_slider__admin_menu_go_prosmart_slider__admin_menu
Data Attributes
data-smart-slider-id
JS Globals
window.N2GSAPwindow.N2PLATFORM_N2
REST Endpoints
/wp-json/smart-slider-3/
Shortcode Output
[smartslider3
FAQ

Frequently Asked Questions about Smart Slider 3