Skip to content
Noroxi

Shortcodes Ultimate – Content Elements

shortcodes-ultimate · plugin

Known security vulnerabilities for Shortcodes Ultimate – Content Elements. Find out in seconds which version runs on your site with WP Lens.

27 known vulnerabilities

1 critical · 4 exploitable without logging in · 1 with public exploit code · latest Apr 15, 2026

Listed on wordpress.org · latest 7.9.1 · last updated Sep 25, 2026 · 400K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2017-18580unauthenticated

    The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

    Critical 9.8

  • CVE-2022-41136unauthenticated · needs a click≤ 5.12.0

    WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

    High 8.8

  • CVE-2023-25050login required≤ 5.12.6

    WordPress Shortcodes Ultimate plugin <= 5.12.6 - Arbitrary File Download vulnerability

    High 7.1

  • CVE-2025-49244login required≤ 7.3.5

    WordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2023-23800login required≤ 5.12.6

    WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)

    Medium 6.5

  • CVE-2026-3885contributor+≤ 7.4.9

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode

    Medium 6.4

  • CVE-2026-0738contributor+≤ 7.4.8

    Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode

    Medium 6.4

  • CVE-2026-0737contributor+≤ 7.4.7

    Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode

    Medium 6.4

  • CVE-2026-2480contributor+≤ 7.4.10

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute

    Medium 6.4

  • CVE-2025-8015author+≤ 7.4.2

    Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link

    Medium 6.4

  • CVE-2025-7354contributor+≤ 7.4.2

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

    Medium 6.4

  • CVE-2025-7369unauthenticated · needs a click≤ 7.4.2

    Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution

    Medium 6.1

  • CVE-2025-5567contributor+≤ 7.4.0

    Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute

    Medium 5.4

  • CVE-2025-0370contributor+≤ 7.3.3

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter

    Medium 5.4

  • CVE-2024-8500contributor+≤ 7.2.2

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-4821contributor+≤ 7.1.6

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode

    Medium 5.4

  • CVE-2024-4553contributor+≤ 7.1.5

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode

    Medium 5.4

  • CVE-2024-3550contributor+≤ 7.1.2

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2024-0792contributor+≤ 7.0.1

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

    Medium 5.4

  • CVE-2024-1808contributor+≤ 7.0.3

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode

    Medium 5.4

  • CVE-2024-1510contributor+≤ 7.0.2

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode

    Medium 5.4

  • CVE-2023-6488contributor+≤ 7.0.0

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2023-6225contributor+≤ 5.13.3

    WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2023-25040contributor+≤ 5.12.6

    WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2017-2245login required

    Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspeci

    Medium 5.0

  • CVE-2022-38086unauthenticated · needs a click≤ 5.12.0

    WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2023-6226contributor+≤ 5.13.3

    WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory