WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal
5.0
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE CVE-2017-2245
CVSS 5.0 (Medium)
Publicly Published June 23, 2017
Last Updated January 25, 2023
Researcher Chris Liu

Description

Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.

References

Share

Vulnerability Details for Shortcodes Ultimate – Content Elements

Shortcodes Ultimate – Content Elements

Software Type Plugin
Software Slug shortcodes-ultimate (view on wordpress.org)
Patched? Yes
Remediation Update to version 4.10.0, or a newer patched version
Affected Version
  • < 4.10.0
Patched Version
  • 4.10.0

Recent vulnerabilities in Shortcodes Ultimate – Content Elements

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
6.4
CVE-2026-3885
Apr 15, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
6.4
CVE-2026-0738
Apr 3, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
6.4
CVE-2026-0737
Apr 3, 2026
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
6.4
CVE-2026-2480
Mar 31, 2026
Researcher: Michael Iden (Mickhat)
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
6.4
CVE-2025-12800
Nov 23, 2025
Researcher: apolo2
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
6.4
CVE-2025-8015
Jul 21, 2025
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
6.4
CVE-2025-7354
Jul 20, 2025
Researcher: stealthcopter
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
6.1
CVE-2025-7369
Jul 20, 2025
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
6.4
CVE-2025-5567
Jul 3, 2025
Researcher: Asaf Mozes
# Title CVE ID CVSS Researchers Date
1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
2 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode CVE-2026-3885 6.4 Dmitrii Ignatyev April 15, 2026
3 Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode CVE-2026-0738 6.4 Dmitrii Ignatyev April 3, 2026
4 Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode CVE-2026-0737 6.4 Dmitrii Ignatyev April 3, 2026
5 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute CVE-2026-2480 6.4 Michael Iden (Mickhat) March 31, 2026
6 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery CVE-2025-12800 6.4 apolo2 November 23, 2025
7 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link CVE-2025-8015 6.4 Dmitrii Ignatyev July 21, 2025
8 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes CVE-2025-7354 6.4 stealthcopter July 20, 2025
9 Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution CVE-2025-7369 6.1 Dmitrii Ignatyev July 20, 2025
10 Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute CVE-2025-5567 6.4 Asaf Mozes July 3, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation