WP Shortcodes Plugin — Shortcodes Ultimate

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Shortcodes Plugin — Shortcodes Ultimate

Information

Software Type Plugin
Software Slug shortcodes-ultimate (view on wordpress.org)
Software Status Active
Software Author gn_themes
Software Website getshortcodes.com
Software Downloads 17,471,757
Software Active Installs 600,000
Software Record Last Updated October 1, 2023

13 vulnerabilities

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure
6.5
CVE-2023-0911
Feb 27, 2023
Researcher: Erwan LR
Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode
4.3
CVE-2023-0890
Feb 27, 2023
Researcher: Erwan LR
Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting
6.4
CVE-2023-25040
Feb 10, 2023
Researcher: Rafie Muhammad
Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery
6.5
CVE-2023-23800
Feb 10, 2023
Researcher: Rafie Muhammad
Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode
6.5
CVE-2023-25050
Feb 10, 2023
Researcher: Rafie Muhammad
Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE ID Unknown
Oct 13, 2022
Researcher: Dave Jong
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery
8.8
CVE-2022-41136
Oct 13, 2022
Researcher: Dave Jong
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery
8.8
CVE-2022-38086
Oct 2, 2022
Researcher: Dave Jong
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
5.4
CVE-2021-24525
Aug 23, 2021
Researcher: apple502j
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
8.8
CVE-2017-18580
Oct 31, 2017
Researcher: Robert Mathews
WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal
5.0
CVE-2017-2245
Jun 23, 2017
Researcher: Chris Liu
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting
6.1
CVE ID Unknown
May 5, 2015
Researcher: Kacper Szurek
Title CVE ID CVSS Researchers Date
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure CVE-2023-0911 6.5 Erwan LR February 27, 2023
Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode CVE-2023-0890 4.3 Erwan LR February 27, 2023
Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting CVE-2023-25040 6.4 Rafie Muhammad February 10, 2023
Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2023-23800 6.5 Rafie Muhammad February 10, 2023
Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode CVE-2023-25050 6.5 Rafie Muhammad February 10, 2023
Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting 6.4 Dave Jong October 13, 2022
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery CVE-2022-41136 8.8 Dave Jong October 13, 2022
Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery CVE-2022-38086 8.8 Dave Jong October 2, 2022
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2021-24525 5.4 apple502j August 23, 2021
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution CVE-2017-18580 8.8 Robert Mathews October 31, 2017
WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal CVE-2017-2245 5.0 Chris Liu June 23, 2017
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting 6.1 Kacper Szurek May 5, 2015

All the threat data shared in this database is powered by Wordfence Intelligence Enterprise.
Interested in integrating this data into your platform or network?
Contact us now to discuss API access to our Wordfence Intelligence Enterprise Data Feeds.

Inquire Now

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation