WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery

Wordfence Intelligence   >   Vulnerability Database   >   WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
6.4
Server-Side Request Forgery (SSRF)
CVE CVE-2025-12800
CVSS 6.4 (Medium)
Publicly Published November 23, 2025
Last Updated November 23, 2025
Researcher apolo2

Description

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers

References

Share

Vulnerability Details for Shortcodes Ultimate – Content Elements

Shortcodes Ultimate – Content Elements

Software Type Plugin
Software Slug shortcodes-ultimate (view on wordpress.org)
Patched? Yes
Remediation Update to version 7.4.6, or a newer patched version
Affected Version
  • <= 7.4.5
Patched Version
  • 7.4.6

Recent vulnerabilities in Shortcodes Ultimate – Content Elements

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
6.4
CVE-2026-3885
Apr 15, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
6.4
CVE-2026-0738
Apr 3, 2026
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
6.4
CVE-2026-0737
Apr 3, 2026
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
6.4
CVE-2026-2480
Mar 31, 2026
Researcher: Michael Iden (Mickhat)
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
6.4
CVE-2025-8015
Jul 21, 2025
Researcher: Dmitrii Ignatyev
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
6.4
CVE-2025-7354
Jul 20, 2025
Researcher: stealthcopter
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
6.1
CVE-2025-7369
Jul 20, 2025
Researcher: Dmitrii Ignatyev
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
6.4
CVE-2025-5567
Jul 3, 2025
Researcher: Asaf Mozes
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
6.4
CVE-2024-5647
Jul 2, 2025
Researcher: Webbernaut
# Title CVE ID CVSS Researchers Date
1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
2 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode CVE-2026-3885 6.4 Dmitrii Ignatyev April 15, 2026
3 Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode CVE-2026-0738 6.4 Dmitrii Ignatyev April 3, 2026
4 Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode CVE-2026-0737 6.4 Dmitrii Ignatyev April 3, 2026
5 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute CVE-2026-2480 6.4 Michael Iden (Mickhat) March 31, 2026
6 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link CVE-2025-8015 6.4 Dmitrii Ignatyev July 21, 2025
7 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes CVE-2025-7354 6.4 stealthcopter July 20, 2025
8 Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution CVE-2025-7369 6.1 Dmitrii Ignatyev July 20, 2025
9 Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute CVE-2025-5567 6.4 Asaf Mozes July 3, 2025
10 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library CVE-2024-5647 6.4 Webbernaut July 2, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation