WordPress Shortcodes Ultimate plugin <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 5.9
WordPress Shortcodes Ultimate plugin <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress WP Shortcodes Plugin - Shortcodes Ultimate plugin <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Server Side Request Forgery (SSRF)
- Score:
- 5.5
References
PatchStack
CVE
Timeline
- Publicly Published
- 2025-12-31
- Created
- 2025-12-31
WordPress Shortcodes Ultimate plugin <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 5.9
WordPress Shortcodes Ultimate plugin <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Request Forgery (CSRF)
- Score:
- 4.3
WordPress Shortcodes Ultimate plugin <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) Vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
References
PatchStack
CVE
Timeline
- Publicly Published
- 2025-06-05
- Created
- 2025-06-04
WordPress WP Shortcodes Ultimate plugin <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress WP Shortcodes Plugin — Shortcodes Ultimate plugin <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin < 7.1.2 - Contributor+ Stored XSS vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin < 7.1.0 - Contributor+ Stored XSS vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress Shortcodes Ultimate plugin < 7.0.5 - Contributor+ Stored XSS vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress WP Shortcodes Plugin — Shortcodes Ultimate plugin <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress WP Shortcodes Ultimate plugin <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
WordPress WP Shortcodes Plugin — Shortcodes Ultimate plugin <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
Wordpress WP Shortcodes Plugin — Shortcodes Ultimate plugin <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5
Wordpress Shortcodes Ultimate plugin <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Insecure Direct Object References (IDOR)
- Score:
- 4.3
Wordpress Shortcodes Ultimate plugin <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Don't mute a vulnerability until you've confirmed your current version has a fix, or the issue doesn't affect your site.
- Type:
- Cross Site Scripting (XSS)
- Score:
- 6.5