Medium severity · published Jan 6, 2026
CVE-2025-13215
Shortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via the auxels_ajax_search due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract titles of draft posts that they should not have access to.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Shortcodes and extra features for Phlox theme · averta
through 2.17.13 · source: vendor
Affected product
SA
Shortcodes and extra features for Phlox theme
averta
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13215
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/auxin-elements/tags/2.17.12/public/includes/frontend-ajax.php#L348
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/7f47ab91-7d91-4231-91ef-66c556ad8496?source=cve
More from Shortcodes and extra features for Phlox theme
9.8
CVE-2024-50500
WordPress Phlox Core Elements plugin <= 2.17.4 - Broken Access Control vulnerability
9.8
CVE-2023-37888
WordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerability
8.8
CVE-2024-31099
WordPress Phlox Core Elements plugin <= 2.15.7 - Broken Access Control vulnerability
8.8
CVE-2022-3359
Shortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection
7.5
CVE-2023-7064
Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer