VendorsGetshortcodesshortcodes_ultimateany version
Vulnerabilities

Getshortcodes Shortcodes Ultimate any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

25CVEs
CVE-2017-18580
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
Published 2019-08-22 · Modified
9.8EPSS 0.121
CVE-2022-41136
WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS
Published 2022-11-08 · Modified
8.8EPSS 0.003
CVE-2023-23800
WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)
Published 2023-11-13 · Modified
7.1EPSS 0.005
CVE-2023-0890
Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access
Published 2023-03-20 · Modified
6.5EPSS 0.007
CVE-2023-0911
Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure
Published 2023-03-20 · Modified
6.5EPSS 0.007
CVE-2023-25040
WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)
Published 2023-03-30 · Modified
6.5EPSS 0.004
CVE-2024-3550
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published 2024-05-02 · Modified
6.4EPSS 0.006
CVE-2023-6225
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2023-11-28 · Modified
6.4EPSS 0.005
CVE-2024-1510
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode
Published 2024-02-20 · Modified
6.4EPSS 0.005
CVE-2024-0792
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Published 2024-02-20 · Modified
6.4EPSS 0.004
CVE-2024-4821
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
Published 2024-06-05 · Modified
6.4EPSS 0.003
CVE-2024-1808
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode
Published 2024-02-28 · Modified
6.4EPSS 0.003
CVE-2024-4553
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
Published 2024-05-21 · Modified
6.4EPSS 0.003
CVE-2025-5567
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
Published 2025-07-04 · Analyzed
6.4EPSS 0.002
CVE-2024-3188
Shortcodes Ultimate < 7.1.0 - Contributor+ Stored XSS
Published 2024-04-26 · Analyzed
6.3EPSS 0.004
CVE-2024-3548
Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS
Published 2024-05-15 · Modified
6.1EPSS 0.004
CVE-2021-24525
Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSS
Published 2021-09-20 · Modified
5.4EPSS 0.006
CVE-2023-6488
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2023-12-19 · Modified
5.4EPSS 0.005
CVE-2024-2583
Shortcodes Ultimate < 7.0.5 - Contributor+ Stored XSS
Published 2024-04-13 · Analyzed
5.4EPSS 0.004
CVE-2024-8500
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published 2024-10-23 · Analyzed
5.4EPSS 0.004
CVE-2024-6766
Shortcodes Ultimate Pro < 7.2.1 - Contributor+ Stored XSS
Published 2024-08-06 · Analyzed
5.4EPSS 0.003
CVE-2022-38086
WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability
Published 2022-10-11 · Modified
5.4EPSS 0.003
CVE-2017-2245
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.
Published 2017-07-07 · Modified
5.0EPSS 0.026
CVE-2024-4217
Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS
Published 2024-07-13 · Analyzed
4.7EPSS 0.005
CVE-2023-6226
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
Published 2023-11-28 · Modified
4.3EPSS 0.005