Shortcodes Ultimate – Content Elements

Уязвимости

• CVE-2017-18580без авторизации

  The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

  Критич. 9.8

• CVE-2022-41136без авторизации · нужен клик≤ 5.12.0

  WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

  Высокий 8.8

• CVE-2023-25050нужен вход≤ 5.12.6

  WordPress Shortcodes Ultimate plugin <= 5.12.6 - Arbitrary File Download vulnerability

  Высокий 7.1

• CVE-2025-49244нужен вход≤ 7.3.5

  WordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) Vulnerability

  Средний 6.5

• CVE-2023-23800нужен вход≤ 5.12.6

  WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)

  Средний 6.5

• CVE-2026-3885участник+≤ 7.4.9

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode

  Средний 6.4

• CVE-2026-0738участник+≤ 7.4.8

  Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode

  Средний 6.4

• CVE-2026-0737участник+≤ 7.4.7

  Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode

  Средний 6.4

• CVE-2026-2480участник+≤ 7.4.10

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute

  Средний 6.4

• CVE-2025-8015автор+≤ 7.4.2

  Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link

  Средний 6.4

• CVE-2025-7354участник+≤ 7.4.2

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

  Средний 6.4

• CVE-2025-7369без авторизации · нужен клик≤ 7.4.2

  Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution

  Средний 6.1

• CVE-2025-5567участник+≤ 7.4.0

  Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute

  Средний 5.4

• CVE-2025-0370участник+≤ 7.3.3

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter

  Средний 5.4

• CVE-2024-8500участник+≤ 7.2.2

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

  Средний 5.4

• CVE-2024-4821участник+≤ 7.1.6

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode

  Средний 5.4

• CVE-2024-4553участник+≤ 7.1.5

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode

  Средний 5.4

• CVE-2024-3550участник+≤ 7.1.2

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Средний 5.4

• CVE-2024-0792участник+≤ 7.0.1

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

  Средний 5.4

• CVE-2024-1808участник+≤ 7.0.3

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode

  Средний 5.4

• CVE-2024-1510участник+≤ 7.0.2

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode

  Средний 5.4

• CVE-2023-6488участник+≤ 7.0.0

  WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2023-6225участник+≤ 5.13.3

  WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2023-25040участник+≤ 5.12.6

  WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)

  Средний 5.4

• CVE-2017-2245нужен вход

  Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspeci

  Средний 5.0

• CVE-2022-38086без авторизации · нужен клик≤ 5.12.0

  WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2023-6226участник+≤ 5.13.3

  WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure

  Средний 4.3