Shortcodes Ultimate
Vova
Developer
7.5.0
Latest version
400,000
Installations
No date
Last updated
Vulnerability history
1 present
31 patched
5 Mitigation rules
- Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode vulnerability<= 7.4.73 days ago
- authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode vulnerability<= 7.4.83 days ago
- WordPress WP Shortcodes Plugin - Shortcodes Ultimate plugin <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute vulnerability<= 7.4.106 days ago
- Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library vulnerability<= 7.4.231/12/2025
- Authenticated (Administrator+) Server-Side Request Forgery vulnerability<= 7.4.531/12/2025
- Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link vulnerability<= 7.4.222/07/2025
- Cross-Site Request Forgery to Arbitrary Shortcode Execution vulnerability<= 7.4.221/07/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes vulnerability<= 7.4.221/07/2025
- Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute vulnerability<= 7.4.003/07/2025
- Cross Site Scripting (XSS) Vulnerability<= 7.3.505/06/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter vulnerability<= 7.3.304/03/2025
- Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability<= 7.2.223/10/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode vulnerability<= 7.1.605/06/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode vulnerability<= 7.1.521/05/2024
- Contributor+ Stored XSS vulnerability< 7.1.215/05/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability<= 7.1.230/04/2024
- Contributor+ Stored XSS vulnerability< 7.1.026/04/2024
- Contributor+ Stored XSS vulnerability< 7.0.515/04/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode vulnerability<= 7.0.328/02/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode vulnerability<= 7.0.220/02/2024
- Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode vulnerability<= 7.0.108/02/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 7.0.018/12/2023
- Insecure Direct Object Reference to Information Disclosure vulnerability<= 5.13.328/11/2023
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 5.13.328/11/2023
- Reflected Cross Site Scripting (XSS) vulnerability<= 5.13.018/07/2023
- Subscriber+ User Meta Disclosure vulnerability< 5.12.806/03/2023
- Server Side Request Forgery (SSRF) vulnerability<= 5.12.610/02/2023
- Arbitrary File Download vulnerability<= 5.12.610/02/2023
- Cross Site Scripting (XSS) vulnerability<= 5.12.610/02/2023
- CSRF vulnerability leading to Stored XSS<= 5.12.013/10/2022
- Cross-Site Request Forgery (CSRF) vulnerability<= 5.12.002/10/2022
- Stored Cross-Site Scripting (XSS) vulnerability<= 5.10.123/08/2021