Shortcodes Ultimate – Content Elements

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Shortcodes Ultimate – Content Elements

Information

Software Type Plugin
Software Slug shortcodes-ultimate (view on wordpress.org)
Software Status Active
Software Author gn_themes
Software Website getshortcodes.com
Software Downloads 25,568,345
Software Active Installs 400,000
Software Record Last Updated July 22, 2026

Showing 1-20 of 39 Vulnerabilities

Submit a Vulnerability
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
6.4
CVE-2026-3885
Apr 15, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
6.4
CVE-2026-0738
Apr 3, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
6.4
CVE-2026-0737
Apr 3, 2026
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
6.4
CVE-2026-2480
Mar 31, 2026
Researcher: Michael Iden (Mickhat)
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
6.4
CVE-2025-12800
Nov 23, 2025
Researcher: apolo2
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
6.4
CVE-2025-8015
Jul 21, 2025
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
6.4
CVE-2025-7354
Jul 20, 2025
Researcher: stealthcopter
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
6.1
CVE-2025-7369
Jul 20, 2025
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
6.4
CVE-2025-5567
Jul 3, 2025
Researcher: Asaf Mozes
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
6.4
CVE-2024-5647
Jul 2, 2025
Researcher: Webbernaut
Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-49244
Jun 5, 2025
Researcher: Muhammad Yudha - DJ
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
6.4
CVE-2025-0370
Mar 3, 2025
Researcher: stealthcopter
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
5.4
CVE-2024-8500
Oct 22, 2024
Researcher: Webbernaut
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
6.4
CVE-2024-4821
Jun 4, 2024
Researcher: Richard Telleng (stueotue)
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
6.4
CVE-2024-4553
May 20, 2024
Researcher: wesley (wcraft)
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-3550
Apr 29, 2024
Researcher: stealthcopter
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox
6.4
CVE-2024-3548
Apr 24, 2024
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-3188
Apr 5, 2024
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode
6.4
CVE-2024-2583
Mar 23, 2024
Researcher: Dmitrii Ignatyev
Title Status CVE ID CVSS Researchers Date
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Patched CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode Patched CVE-2026-3885 6.4 Dmitrii Ignatyev April 15, 2026
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode Patched CVE-2026-0738 6.4 Dmitrii Ignatyev April 3, 2026
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode Patched CVE-2026-0737 6.4 Dmitrii Ignatyev April 3, 2026
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute Patched CVE-2026-2480 6.4 Michael Iden (Mickhat) March 31, 2026
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery Patched CVE-2025-12800 6.4 apolo2 November 23, 2025
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link Patched CVE-2025-8015 6.4 Dmitrii Ignatyev July 21, 2025
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes Patched CVE-2025-7354 6.4 stealthcopter July 20, 2025
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution Patched CVE-2025-7369 6.1 Dmitrii Ignatyev July 20, 2025
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute Patched CVE-2025-5567 6.4 Asaf Mozes July 3, 2025
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library Patched CVE-2024-5647 6.4 Webbernaut July 2, 2025
Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-49244 6.4 Muhammad Yudha - DJ June 5, 2025
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter Patched CVE-2025-0370 6.4 stealthcopter March 3, 2025
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Patched CVE-2024-8500 5.4 Webbernaut October 22, 2024
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode Patched CVE-2024-4821 6.4 Richard Telleng (stueotue) June 4, 2024
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode Patched CVE-2024-4553 6.4 wesley (wcraft) May 20, 2024
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-3550 6.4 stealthcopter April 29, 2024
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Patched CVE-2024-3548 6.4 Dmitrii Ignatyev April 24, 2024
Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-3188 6.4 Dmitrii Ignatyev April 5, 2024
Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode Patched CVE-2024-2583 6.4 Dmitrii Ignatyev March 23, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation