WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure

Wordfence Intelligence   >   Vulnerability Database   >   WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
4.3
Authorization Bypass Through User-Controlled Key
CVE CVE-2023-6226
CVSS 4.3 (Medium)
Publicly Published November 27, 2023
Last Updated January 22, 2024
Researcher Francesco Carlucci

Description

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin.

References

Share

Vulnerability Details for Shortcodes Ultimate – Content Elements

Shortcodes Ultimate – Content Elements

Software Type Plugin
Software Slug shortcodes-ultimate (view on wordpress.org)
Patched? Yes
Remediation Update to version 7.0.0, or a newer patched version
Affected Version
  • <= 5.13.3
Patched Version
  • 7.0.0

Recent vulnerabilities in Shortcodes Ultimate – Content Elements

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
6.4
CVE-2026-3885
Apr 15, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
6.4
CVE-2026-0738
Apr 3, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
6.4
CVE-2026-0737
Apr 3, 2026
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
6.4
CVE-2026-2480
Mar 31, 2026
Researcher: Michael Iden (Mickhat)
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
6.4
CVE-2025-12800
Nov 23, 2025
Researcher: apolo2
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
6.4
CVE-2025-8015
Jul 21, 2025
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
6.4
CVE-2025-7354
Jul 20, 2025
Researcher: stealthcopter
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
6.1
CVE-2025-7369
Jul 20, 2025
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
6.4
CVE-2025-5567
Jul 3, 2025
Researcher: Asaf Mozes
# Title CVE ID CVSS Researchers Date
1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
2 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode CVE-2026-3885 6.4 Dmitrii Ignatyev April 15, 2026
3 Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode CVE-2026-0738 6.4 Dmitrii Ignatyev April 3, 2026
4 Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode CVE-2026-0737 6.4 Dmitrii Ignatyev April 3, 2026
5 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute CVE-2026-2480 6.4 Michael Iden (Mickhat) March 31, 2026
6 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery CVE-2025-12800 6.4 apolo2 November 23, 2025
7 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link CVE-2025-8015 6.4 Dmitrii Ignatyev July 21, 2025
8 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes CVE-2025-7354 6.4 stealthcopter July 20, 2025
9 Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution CVE-2025-7369 6.1 Dmitrii Ignatyev July 20, 2025
10 Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute CVE-2025-5567 6.4 Asaf Mozes July 3, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation