Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Smart PostPost Carousel Slider for ElementorCustom Post Carousels with OwlMulti Post Carousel by CategoryPost Carousel Slider
Plugin · post-carousel
Smart Post
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 5, 2026Smart Post: Does not check the typeCVE-2026-78150 · fixed in 4.0.8 · reported by WPScanLow 2.7
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.
Sep 5, 2026Smart Post: Does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX actionCVE-2026-78149 · fixed in 4.0.8 · reported by WPScanMedium 5.3
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.
Apr 14, 2026Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts: PHP Object InjectionCVE-2026-3017 · affects up to 3.0.12 · reported by WordfenceHigh 7.2
The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · fixed in 3.0.1 · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-3996 · fixed in 2.4.28 · reported by WPScanLow 3.5
The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.