Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

24 vulnerabilities by gn_themes

CVE-2024-13362 (GCVE-0-2024-13362)

Vulnerability from cvelistv5 – Published: 2026-05-01 05:29 – Updated: 2026-05-01 13:23
VLAI?
Title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Summary
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity ?
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
sebet Go Fetch Jobs (for WP Job Manager) Affected: 0 , ≤ 1.8.4.8.1 (semver)
Create a notification for this product.
    5starplugins Dynamic Copyright Year Affected: 0 , ≤ 1.0.4 (semver)
Create a notification for this product.
    peterschulznl Code Manager Affected: 0 , ≤ 1.0.40 (semver)
Create a notification for this product.
    bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior Affected: 0 , ≤ 1.1.3 (semver)
Create a notification for this product.
    yuvalo Goal Tracker – Custom Event Tracking for GA4 Affected: 0 , ≤ 1.1.5 (semver)
Create a notification for this product.
    essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Affected: 0 , ≤ 1.1.13 (semver)
Create a notification for this product.
    josevega WP Page Templates Affected: 0 , ≤ 1.1.16 (semver)
Create a notification for this product.
    hkdigitalagency Payment Gateway for ACBA BANK Affected: 0 , ≤ 1.2.6 (semver)
Create a notification for this product.
    princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress Affected: 0 , ≤ 1.2.7 (semver)
Create a notification for this product.
    spiderdevs Forumax – AI Powered Advanced Community Forum Plugin Affected: 0 , ≤ 1.2.7 (semver)
Create a notification for this product.
    seezee Five-Star Ratings Shortcode Affected: 0 , ≤ 1.2.56 (semver)
Create a notification for this product.
    oxilab Product Layouts for WooCommerce Affected: 0 , ≤ 1.3.1 (semver)
Create a notification for this product.
    mr2p Meta Field Block – Display custom fields in the Block Editor without coding Affected: 0 , ≤ 1.3.3 (semver)
Create a notification for this product.
    themelocation Custom WooCommerce Checkout Fields Editor Affected: 0 , ≤ 1.3.4 (semver)
Create a notification for this product.
    100plugins Open User Map Affected: 0 , ≤ 1.4.0 (semver)
Create a notification for this product.
    wpdever WP Notification Bell Affected: 0 , ≤ 1.4.2 (semver)
Create a notification for this product.
    themelocation Remove Add to Cart WooCommerce Affected: 0 , ≤ 1.4.7 (semver)
Create a notification for this product.
    princeahmed File Manager for Google Drive – Integrate Google Drive Affected: 0 , ≤ 1.4.9 (semver)
Create a notification for this product.
    5starplugins Marijuana Age Verify Affected: 0 , ≤ 1.5.5 (semver)
Create a notification for this product.
    infosatech RevivePress – Keep your Old Content Evergreen Affected: 0 , ≤ 1.5.8 (semver)
Create a notification for this product.
    nicheaddons Restaurant & Cafe Addon for Elementor Affected: 0 , ≤ 1.5.8 (semver)
Create a notification for this product.
    paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter Affected: 0 , ≤ 1.5.10 (semver)
Create a notification for this product.
    unitecms Unlimited Elements For Elementor Affected: 0 , ≤ 1.5.140 (semver)
Create a notification for this product.
    meowcrew Role Based Pricing for Woo by Meow Crew Affected: 0 , ≤ 1.6.0 (semver)
Create a notification for this product.
    nicheaddons Primary Addon for Elementor Affected: 0 , ≤ 1.6.0 (semver)
Create a notification for this product.
    5starplugins Featured Images in RSS for Mailchimp & More Affected: 0 , ≤ 1.6.3 (semver)
Create a notification for this product.
    wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI Affected: 0 , ≤ 1.6.3 (semver)
Create a notification for this product.
    kofimokome Message Filter for Contact Form 7 Affected: 0 , ≤ 1.6.3.2 (semver)
Create a notification for this product.
    paretodigital Embedder for Google Reviews Affected: 0 , ≤ 1.6.6 (semver)
Create a notification for this product.
    interactivegeomaps MapGeo – Interactive Geo Maps Affected: 0 , ≤ 1.6.22 (semver)
Create a notification for this product.
    wpbits WPBITS Addons For Elementor Page Builder Affected: 0 , ≤ 1.7 (semver)
Create a notification for this product.
    toddhalfpenny Widgets on Pages Affected: 0 , ≤ 1.7 (semver)
Create a notification for this product.
    rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget Affected: 0 , ≤ 1.7.0 (semver)
Create a notification for this product.
    tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms Affected: 0 , ≤ 1.7.0 (semver)
Create a notification for this product.
    webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Affected: 0 , ≤ 1.7.2 (semver)
Create a notification for this product.
    hasanazizul Text To Speech TTS Accessibility Affected: 0 , ≤ 1.7.34 (semver)
Create a notification for this product.
    5starplugins Easy Age Verify Affected: 0 , ≤ 1.8.5 (semver)
Create a notification for this product.
    senols AI Puffer – Chat. Create. Automate. (formerly AI Power) Affected: 0 , ≤ 1.8.99 (semver)
Create a notification for this product.
    damian-gora Justified Gallery Affected: 0 , ≤ 1.9.0 (semver)
Create a notification for this product.
    mapster Mapster WP Maps Affected: 0 , ≤ 1.9.0 (semver)
Create a notification for this product.
    streamweasels StreamWeasels Twitch Integration Affected: 0 , ≤ 1.9.2 (semver)
Create a notification for this product.
    xplodedthemes XT Variation Swatches for WooCommerce Affected: 0 , ≤ 1.9.4 (semver)
Create a notification for this product.
    bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection Affected: 0 , ≤ 1.9.8 (semver)
Create a notification for this product.
    kaizencoders URL Shortify – Simple and Easy URL Shortener Affected: 0 , ≤ 1.10.4 (semver)
Create a notification for this product.
    uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce Affected: 0 , ≤ 1.10.6 (semver)
Create a notification for this product.
    cyberhobo Geo Mashup Affected: 0 , ≤ 1.13.15 (semver)
Create a notification for this product.
    josevega Disable Payment Methods based on cart conditions for WooCommerce Affected: 0 , ≤ 1.16.3 (semver)
Create a notification for this product.
    pagup Automatic Internal Links for SEO by Pagup Affected: 0 , ≤ 2.0.0 (semver)
Create a notification for this product.
    enweby Full Screen Background Affected: 0 , ≤ 2.0.2 (semver)
Create a notification for this product.
    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Affected: 0 , ≤ 2.0.7.2 (semver)
Create a notification for this product.
    princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Affected: 0 , ≤ 2.0.82 (semver)
Create a notification for this product.
    spicethemes Carousel, Recent Post Slider and Banner Slider Affected: 0 , ≤ 2.1 (semver)
Create a notification for this product.
    pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) Affected: 0 , ≤ 2.1.0 (semver)
Create a notification for this product.
    xplodedthemes XT Quick View for WooCommerce Affected: 0 , ≤ 2.1.5 (semver)
Create a notification for this product.
    pluginscafe Smart phone field for Gravity Forms Affected: 0 , ≤ 2.1.6 (semver)
Create a notification for this product.
    fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Affected: 0 , ≤ 2.1.34 (semver)
Create a notification for this product.
    bplugins PDF Poster – Display PDF Files with Custom Viewer Affected: 0 , ≤ 2.2.0 (semver)
Create a notification for this product.
    nicheaddons Events Addon for Elementor Affected: 0 , ≤ 2.2.2 (semver)
Create a notification for this product.
    bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Affected: 0 , ≤ 2.2.27 (semver)
Create a notification for this product.
    mte90 Glossary Affected: 0 , ≤ 2.2.38 (semver)
Create a notification for this product.
    tickera Restrict – membership, site, content and user access restrictions for WordPress Affected: 0 , ≤ 2.3.0 (semver)
Create a notification for this product.
    cyclonecode Custom PHP Settings Affected: 0 , ≤ 2.3.1 (semver)
Create a notification for this product.
    prasadkirpekar WP Meta and Date Remover Affected: 0 , ≤ 2.3.4 (semver)
Create a notification for this product.
    fullworks Anti-Spam Protection – No API Key, GDPR Friendly Affected: 0 , ≤ 2.3.7 (semver)
Create a notification for this product.
    premmerce Premmerce Permalink Manager for WooCommerce Affected: 0 , ≤ 2.3.11 (semver)
Create a notification for this product.
    smartwpress Music Player for Elementor – Audio Player & Podcast Player Affected: 0 , ≤ 2.4.1 (semver)
Create a notification for this product.
    mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More Affected: 0 , ≤ 2.4.1 (semver)
Create a notification for this product.
    oceanwp Ocean Extra Affected: 0 , ≤ 2.4.2 (semver)
Create a notification for this product.
    fooplugins Gallery by FooGallery Affected: 0 , ≤ 2.4.27 (semver)
Create a notification for this product.
    plugins360 Automatic YouTube Gallery Affected: 0 , ≤ 2.5.5 (semver)
Create a notification for this product.
    spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder Affected: 0 , ≤ 2.5.7 (semver)
Create a notification for this product.
    samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Affected: 0 , ≤ 2.5.8 (semver)
Create a notification for this product.
    tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! Affected: 0 , ≤ 2.5.9 (semver)
Create a notification for this product.
    kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages Affected: 0 , ≤ 2.5.9 (semver)
Create a notification for this product.
    wpjoli Joli Table Of Contents Affected: 0 , ≤ 2.6.0 (semver)
Create a notification for this product.
    passionatebrains GA4WP – Analytics Dashboard for the Website Affected: 0 , ≤ 2.6.0 (semver)
Create a notification for this product.
    nitin247 Place Order Without Payment for WooCommerce Affected: 0 , ≤ 2.6.5 (semver)
Create a notification for this product.
    wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Affected: 0 , ≤ 2.6.7 (semver)
Create a notification for this product.
    mihail-barinov Share This Image Affected: 0 , ≤ 2.07 (semver)
Create a notification for this product.
    inavii Inavii Social Feed Affected: 0 , ≤ 2.7.0 (semver)
Create a notification for this product.
    fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox Affected: 0 , ≤ 2.7.33 (semver)
Create a notification for this product.
    xplodedthemes XT Floating Cart for WooCommerce Affected: 0 , ≤ 2.8.4 (semver)
Create a notification for this product.
    takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu Affected: 0 , ≤ 2.8.6 (semver)
Create a notification for this product.
    passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization Affected: 0 , ≤ 2.9.2 (semver)
Create a notification for this product.
    bensibley Independent Analytics Affected: 0 , ≤ 2.9.7 (semver)
Create a notification for this product.
    codesavory Knowledge Base documentation & wiki plugin – BasePress Docs Affected: 0 , ≤ 2.16.3.3 (semver)
Create a notification for this product.
    davidanderson Internal Link Juicer: SEO Auto Linker for WordPress Affected: 0 , ≤ 2.24.6 (semver)
Create a notification for this product.
    josevega Bulk Edit Posts and Products in Spreadsheet Affected: 0 , ≤ 2.25.16 (semver)
Create a notification for this product.
    saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Affected: 0 , ≤ 3.0.0 (semver)
Create a notification for this product.
    tobiasbg TablePress – Tables in WordPress made easy Affected: 0 , ≤ 3.0.2 (semver)
Create a notification for this product.
    bouncingsprout Ultimeter Affected: 0 , ≤ 3.0.5 (semver)
Create a notification for this product.
    blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles Affected: 0 , ≤ 3.0.6 (semver)
Create a notification for this product.
    mattpramschufer Pay For Post with WooCommerce Affected: 0 , ≤ 3.1.26 (semver)
Create a notification for this product.
    koen12344 Post to Google My Business (Google Business Profile) Affected: 0 , ≤ 3.1.28 (semver)
Create a notification for this product.
    imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers Affected: 0 , ≤ 3.2.2 (semver)
Create a notification for this product.
    pluginsware Advanced Classifieds & Directory Pro Affected: 0 , ≤ 3.2.4 (semver)
Create a notification for this product.
    gallerycreator Mixed Media Gallery Blocks Affected: 0 , ≤ 3.2.4.4 (semver)
Create a notification for this product.
    blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Affected: 0 , ≤ 3.2.6 (semver)
Create a notification for this product.
    mhmrajib AidWP – Donation & Payment Forms (Stripe Powered) Affected: 0 , ≤ 3.2.6 (semver)
Create a notification for this product.
    infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid Affected: 0 , ≤ 3.2.7 (semver)
Create a notification for this product.
    pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Affected: 0 , ≤ 3.2.7 (semver)
Create a notification for this product.
    samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews Affected: 0 , ≤ 3.2.8 (semver)
Create a notification for this product.
    wpspeedo Team Members Showcase Affected: 0 , ≤ 3.3.0 (semver)
Create a notification for this product.
    elespare EleSpare – News, Magazine and Blog Addons for Elementor Affected: 0 , ≤ 3.3.2 (semver)
Create a notification for this product.
    infornweb Post List Designer – Category Post, Recent Post, Post List Affected: 0 , ≤ 3.3.7 (semver)
Create a notification for this product.
    infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Affected: 0 , ≤ 3.4.9 (semver)
Create a notification for this product.
    dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress Affected: 0 , ≤ 3.4.12 (semver)
Create a notification for this product.
    xplodedthemes WPIDE – File Manager & Code Editor Affected: 0 , ≤ 3.5.1 (semver)
Create a notification for this product.
    premmerce Premmerce Product Filter for WooCommerce Affected: 0 , ≤ 3.7.3 (semver)
Create a notification for this product.
    afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Affected: 0 , ≤ 3.8.3 (semver)
Create a notification for this product.
    wpmagics Delete Posts automatically Affected: 0 , ≤ 3.9.6 (semver)
Create a notification for this product.
    takanakui Menu Image, Icons made easy Affected: 0 , ≤ 3.12 (semver)
Create a notification for this product.
    passionatebrains AWCA – The Great Analytics Insights for Your eStore Affected: 0 , ≤ 3.12.0 (semver)
Create a notification for this product.
    mikewire_rocksolid Announcement & Notification Banner – Bulletin Affected: 0 , ≤ 3.12.1 (semver)
Create a notification for this product.
    nitin247 Thank You Page for WooCommerce Affected: 0 , ≤ 4.2.0 (semver)
Create a notification for this product.
    webheadllc Contact Form 7 Multi-Step Forms Affected: 0 , ≤ 4.4.1 (semver)
Create a notification for this product.
    speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates Affected: 0 , ≤ 4.5.0 (semver)
Create a notification for this product.
    mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes Affected: 0 , ≤ 4.6.8 (semver)
Create a notification for this product.
    webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar Affected: 0 , ≤ 5.0.57 (semver)
Create a notification for this product.
    invisnet WP fail2ban – Advanced Security Affected: 0 , ≤ 5.3.4 (semver)
Create a notification for this product.
    vinod-dalvi Ivory Search – WordPress Search Plugin Affected: 0 , ≤ 5.5.8 (semver)
Create a notification for this product.
    peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Affected: 0 , ≤ 5.5.31 (semver)
Create a notification for this product.
    elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce Affected: 0 , ≤ 5.17.2 (semver)
Create a notification for this product.
    cleverplugins Security Ninja – WordPress Security & Firewall Affected: 0 , ≤ 5.222 (semver)
Create a notification for this product.
    theafricanboss Checkout with Cash App on WooCommerce Affected: 0 , ≤ 6.0.2 (semver)
Create a notification for this product.
    fullworks Display Eventbrite Events Affected: 0 , ≤ 6.1.10 (semver)
Create a notification for this product.
    mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins Affected: 0 , ≤ 6.1.13 (semver)
Create a notification for this product.
    sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Affected: 0 , ≤ 6.6.5 (semver)
Create a notification for this product.
    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.3.3 (semver)
Create a notification for this product.
    gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan Affected: 0 , ≤ 7.7.0 (semver)
Create a notification for this product.
    tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Affected: 0 , ≤ 8.0.7 (semver)
Create a notification for this product.
Credits
Asaf Mozes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-01T13:23:14.835839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-01T13:23:26.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Go Fetch Jobs (for WP Job Manager)",
          "vendor": "sebet",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dynamic Copyright Year",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Code Manager",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "1.0.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Scrollbar \u2013 Custom Scrollbar Styling and Behavior",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Goal Tracker \u2013 Custom Event Tracking for GA4",
          "vendor": "yuvalo",
          "versions": [
            {
              "lessThanOrEqual": "1.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent",
          "vendor": "essekia",
          "versions": [
            {
              "lessThanOrEqual": "1.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Page Templates",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.1.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Payment Gateway for ACBA BANK",
          "vendor": "hkdigitalagency",
          "versions": [
            {
              "lessThanOrEqual": "1.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dracula Dark Mode \u2013  Accessibility, Reading Mode \u0026 Dark Mode for WordPress",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Forumax \u2013 AI Powered Advanced Community Forum Plugin",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Five-Star Ratings Shortcode",
          "vendor": "seezee",
          "versions": [
            {
              "lessThanOrEqual": "1.2.56",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Product Layouts for WooCommerce",
          "vendor": "oxilab",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Meta Field Block \u2013 Display custom fields in the Block Editor without coding",
          "vendor": "mr2p",
          "versions": [
            {
              "lessThanOrEqual": "1.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom WooCommerce Checkout Fields Editor",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Open User Map",
          "vendor": "100plugins",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Notification Bell",
          "vendor": "wpdever",
          "versions": [
            {
              "lessThanOrEqual": "1.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Remove Add to Cart WooCommerce",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "File Manager for Google Drive \u2013 Integrate Google Drive",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Marijuana Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RevivePress \u2013 Keep your Old Content Evergreen",
          "vendor": "infosatech",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restaurant \u0026 Cafe Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.5.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unlimited Elements For Elementor",
          "vendor": "unitecms",
          "versions": [
            {
              "lessThanOrEqual": "1.5.140",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Role Based Pricing for Woo by Meow Crew",
          "vendor": "meowcrew",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Primary Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Featured Images in RSS for Mailchimp \u0026 More",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Image Alt Text Manager \u2013 Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI",
          "vendor": "wpsaad",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Message Filter for Contact Form 7",
          "vendor": "kofimokome",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Embedder for Google Reviews",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MapGeo \u2013 Interactive Geo Maps",
          "vendor": "interactivegeomaps",
          "versions": [
            {
              "lessThanOrEqual": "1.6.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPBITS Addons For Elementor Page Builder",
          "vendor": "wpbits",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Widgets on Pages",
          "vendor": "toddhalfpenny",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spotlight Social Feeds \u2013 Block, Shortcode, and Widget",
          "vendor": "rebelcode",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms",
          "vendor": "tobias_conrad",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o",
          "vendor": "webfactory",
          "versions": [
            {
              "lessThanOrEqual": "1.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Text To Speech TTS Accessibility",
          "vendor": "hasanazizul",
          "versions": [
            {
              "lessThanOrEqual": "1.7.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power)",
          "vendor": "senols",
          "versions": [
            {
              "lessThanOrEqual": "1.8.99",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Justified Gallery",
          "vendor": "damian-gora",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mapster WP Maps",
          "vendor": "mapster",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StreamWeasels Twitch Integration",
          "vendor": "streamweasels",
          "versions": [
            {
              "lessThanOrEqual": "1.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Variation Swatches for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "bBlocks \u2013 Essential Gutenberg Blocks \u0026 Patterns Collection",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "URL Shortify \u2013 Simple and Easy URL Shortener",
          "vendor": "kaizencoders",
          "versions": [
            {
              "lessThanOrEqual": "1.10.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kikote \u2013 Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce",
          "vendor": "uriahs-victor",
          "versions": [
            {
              "lessThanOrEqual": "1.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Geo Mashup",
          "vendor": "cyberhobo",
          "versions": [
            {
              "lessThanOrEqual": "1.13.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Disable Payment Methods based on cart conditions for WooCommerce",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.16.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic Internal Links for SEO by Pagup",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Full Screen Background",
          "vendor": "enweby",
          "versions": [
            {
              "lessThanOrEqual": "2.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
          "vendor": "litonice13",
          "versions": [
            {
              "lessThanOrEqual": "2.0.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "2.0.82",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Carousel, Recent Post Slider and Banner Slider",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Quick View for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Smart phone field for Gravity Forms",
          "vendor": "pluginscafe",
          "versions": [
            {
              "lessThanOrEqual": "2.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.1.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDF Poster \u2013 Display PDF Files with Custom Viewer",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Events Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 \u0026 Audio Player",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Glossary",
          "vendor": "mte90",
          "versions": [
            {
              "lessThanOrEqual": "2.2.38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restrict \u2013 membership, site, content and user access restrictions for WordPress",
          "vendor": "tickera",
          "versions": [
            {
              "lessThanOrEqual": "2.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom PHP Settings",
          "vendor": "cyclonecode",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Meta and Date Remover",
          "vendor": "prasadkirpekar",
          "versions": [
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Anti-Spam Protection \u2013 No API Key, GDPR Friendly",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "2.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Permalink Manager for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "2.3.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Music Player for Elementor \u2013 Audio Player \u0026 Podcast Player",
          "vendor": "smartwpress",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TopNewsWp \u2013 Display Tikcer News, RSS Feed Widget and Many More",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ocean Extra",
          "vendor": "oceanwp",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gallery by FooGallery",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.4.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic YouTube Gallery",
          "vendor": "plugins360",
          "versions": [
            {
              "lessThanOrEqual": "2.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "2.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "2.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!",
          "vendor": "tonyzeoli",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages",
          "vendor": "kaira",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Joli Table Of Contents",
          "vendor": "wpjoli",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GA4WP \u2013 Analytics Dashboard for the Website",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Place Order Without Payment for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "2.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages",
          "vendor": "wordplus",
          "versions": [
            {
              "lessThanOrEqual": "2.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Share This Image",
          "vendor": "mihail-barinov",
          "versions": [
            {
              "lessThanOrEqual": "2.07",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Inavii Social Feed",
          "vendor": "inavii",
          "versions": [
            {
              "lessThanOrEqual": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Lightbox \u0026 Modal Popup WordPress Plugin \u2013 FooBox",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.7.33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Floating Cart for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Independent Analytics",
          "vendor": "bensibley",
          "versions": [
            {
              "lessThanOrEqual": "2.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress Docs",
          "vendor": "codesavory",
          "versions": [
            {
              "lessThanOrEqual": "2.16.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Internal Link Juicer: SEO Auto Linker for WordPress",
          "vendor": "davidanderson",
          "versions": [
            {
              "lessThanOrEqual": "2.24.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Edit Posts and Products in Spreadsheet",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "2.25.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TablePress \u2013 Tables in WordPress made easy",
          "vendor": "tobiasbg",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ultimeter",
          "vendor": "bouncingsprout",
          "versions": [
            {
              "lessThanOrEqual": "3.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TreePress \u2013 Easy Family Trees \u0026 Ancestor Profiles",
          "vendor": "blackandwhitedigital",
          "versions": [
            {
              "lessThanOrEqual": "3.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Pay For Post with WooCommerce",
          "vendor": "mattpramschufer",
          "versions": [
            {
              "lessThanOrEqual": "3.1.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post to Google My Business (Google Business Profile)",
          "vendor": "koen12344",
          "versions": [
            {
              "lessThanOrEqual": "3.1.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Coupons and Deals \u2013 Coupon Plugin For Affiliate Marketers",
          "vendor": "imtiazrayhan",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Classifieds \u0026 Directory Pro",
          "vendor": "pluginsware",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mixed Media Gallery Blocks",
          "vendor": "gallerycreator",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "BlockSpare \u2014 News, Magazine and Blog Addons for (Gutenberg) Block Editor",
          "vendor": "blockspare",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AidWP \u2013 Donation \u0026 Payment Forms (Stripe Powered)",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider \u0026 Logo Grid",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider",
          "vendor": "pluginandplay",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Solid Testimonials \u2013 Testimonial Slider, Video Testimonials \u0026 Customer Reviews",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "3.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members Showcase",
          "vendor": "wpspeedo",
          "versions": [
            {
              "lessThanOrEqual": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EleSpare \u2013 News, Magazine and Blog Addons for Elementor",
          "vendor": "elespare",
          "versions": [
            {
              "lessThanOrEqual": "3.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post List Designer \u2013 Category Post, Recent Post, Post List",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "YASR \u2013 Yet Another Star Rating Plugin for WordPress",
          "vendor": "dashlabsltd",
          "versions": [
            {
              "lessThanOrEqual": "3.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPIDE \u2013 File Manager \u0026 Code Editor",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Product Filter for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "3.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars",
          "vendor": "afthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Delete Posts automatically",
          "vendor": "wpmagics",
          "versions": [
            {
              "lessThanOrEqual": "3.9.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Menu Image, Icons made easy",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "3.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AWCA \u2013 The Great Analytics Insights for Your eStore",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "3.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Announcement \u0026 Notification Banner \u2013 Bulletin",
          "vendor": "mikewire_rocksolid",
          "versions": [
            {
              "lessThanOrEqual": "3.12.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Thank You Page for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Contact Form 7 Multi-Step Forms",
          "vendor": "webheadllc",
          "versions": [
            {
              "lessThanOrEqual": "4.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Auto-Install Free SSL \u2013 Generate \u0026 Install Free SSL Certificates",
          "vendor": "speedify",
          "versions": [
            {
              "lessThanOrEqual": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Books Gallery \u2013 Build Stunning Book Showcases \u0026 Libraries in Minutes",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "4.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Appointment Booking \u0026 Scheduling System \u2013 Webba Booking Calendar",
          "vendor": "webba-agency",
          "versions": [
            {
              "lessThanOrEqual": "5.0.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP fail2ban \u2013 Advanced Security",
          "vendor": "invisnet",
          "versions": [
            {
              "lessThanOrEqual": "5.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ivory Search \u2013 WordPress Search Plugin",
          "vendor": "vinod-dalvi",
          "versions": [
            {
              "lessThanOrEqual": "5.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.31",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce",
          "vendor": "elliotvs",
          "versions": [
            {
              "lessThanOrEqual": "5.17.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Security Ninja \u2013 WordPress Security \u0026 Firewall",
          "vendor": "cleverplugins",
          "versions": [
            {
              "lessThanOrEqual": "5.222",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Checkout with Cash App on WooCommerce",
          "vendor": "theafricanboss",
          "versions": [
            {
              "lessThanOrEqual": "6.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Display Eventbrite Events",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "6.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins",
          "vendor": "mohsinoffline",
          "versions": [
            {
              "lessThanOrEqual": "6.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress",
          "vendor": "sjaved",
          "versions": [
            {
              "lessThanOrEqual": "6.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan",
          "vendor": "gowebsmarty",
          "versions": [
            {
              "lessThanOrEqual": "7.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto",
          "vendor": "tripetto",
          "versions": [
            {
              "lessThanOrEqual": "8.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asaf Mozes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-01T05:29:54.148Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3235286/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3249130/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3229060/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-30T17:32:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-30T17:17:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13362",
    "datePublished": "2026-05-01T05:29:54.148Z",
    "dateReserved": "2025-01-13T18:08:47.439Z",
    "dateUpdated": "2026-05-01T13:23:26.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3885 (GCVE-0-2026-3885)

Vulnerability from cvelistv5 – Published: 2026-04-16 02:25 – Updated: 2026-04-16 12:04
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.9 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T11:12:39.313347Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T12:04:38.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s \u0027su_box\u0027 shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T02:25:17.471Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6929fdc-a5b1-4c71-9291-3fafa9381cf2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-10T15:43:27.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-15T14:02:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-3885",
    "datePublished": "2026-04-16T02:25:17.471Z",
    "dateReserved": "2026-03-10T15:28:10.617Z",
    "dateUpdated": "2026-04-16T12:04:38.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0737 (GCVE-0-2026-0737)

Vulnerability from cvelistv5 – Published: 2026-04-04 07:41 – Updated: 2026-04-08 16:57
VLAI?
Title
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
Summary
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the 'src' attribute of the su_lightbox shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.7 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T17:51:36.827396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T18:02:55.393Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the \u0027src\u0027 attribute of the su_lightbox shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:57:07.456Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62a9c9f4-ace4-4029-a720-5ea077e98be4?source=cve"
        },
        {
          "url": "https://research.cleantalk.org/cve-2026-0737/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.8/includes/shortcodes/lightbox.php?marks=69#L69"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-12-30T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-01-08T16:42:16.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-03T19:32:59.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shortcodes Ultimate \u003c= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027su_lightbox\u0027 Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-0737",
    "datePublished": "2026-04-04T07:41:58.926Z",
    "dateReserved": "2026-01-08T16:20:21.978Z",
    "dateUpdated": "2026-04-08T16:57:07.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0738 (GCVE-0-2026-0738)

Vulnerability from cvelistv5 – Published: 2026-04-04 07:41 – Updated: 2026-04-08 16:55
VLAI?
Title
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
Summary
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.8 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0738",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T15:48:57.663279Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T15:50:13.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the \u0027su_slide_link\u0027 attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:55:30.862Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfc718a-408b-4389-b03b-bfe152ed7b28?source=cve"
        },
        {
          "url": "https://research.cleantalk.org/cve-2026-0738/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=shortcodes-ultimate/tags/7.4.8/includes/shortcodes/carousel.php\u0026new_path=shortcodes-ultimate/tags/7.4.9/includes/shortcodes/carousel.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-06T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-01-08T16:42:19.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-03T19:34:03.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shortcodes Ultimate \u003c= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via \u0027su_carousel\u0027 Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-0738",
    "datePublished": "2026-04-04T07:41:58.385Z",
    "dateReserved": "2026-01-08T16:22:58.964Z",
    "dateUpdated": "2026-04-08T16:55:30.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2480 (GCVE-0-2026-2480)

Vulnerability from cvelistv5 – Published: 2026-03-31 22:26 – Updated: 2026-04-08 16:56
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the `su_box` shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.10 (semver)
Create a notification for this product.
Credits
Michael Iden
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2480",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T15:21:47.162095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T15:52:22.500Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Iden"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027max_width\u0027 attribute of the `su_box` shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:56:53.775Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61ab7a28-bcca-41ff-89d1-c083c6b0d39f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.9/includes/shortcodes/box.php#L107"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.9/includes/shortcodes/box.php#L113"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate/trunk/includes/shortcodes/box.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-13T18:29:12.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-31T10:25:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027max_width\u0027 Shortcode Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-2480",
    "datePublished": "2026-03-31T22:26:03.703Z",
    "dateReserved": "2026-02-13T18:13:56.168Z",
    "dateUpdated": "2026-04-08T16:56:53.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12800 (GCVE-0-2025-12800)

Vulnerability from cvelistv5 – Published: 2025-11-23 22:26 – Updated: 2026-04-08 16:55
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.5 (semver)
Create a notification for this product.
Credits
GABRIEL GERALDINO DE SOUZA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12800",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-24T17:19:34.930874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-24T17:19:43.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "GABRIEL GERALDINO DE SOUZA"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the \u0027Unsafe features\u0027 option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:55:40.023Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb7db4-bef7-4799-9b65-ebe77976e21c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3397946/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-29T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-11-06T12:18:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-11-23T10:11:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-12800",
    "datePublished": "2025-11-23T22:26:39.686Z",
    "dateReserved": "2025-11-06T12:02:44.591Z",
    "dateUpdated": "2026-04-08T16:55:40.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-8015 (GCVE-0-2025-8015)

Vulnerability from cvelistv5 – Published: 2025-07-22 14:43 – Updated: 2026-04-08 17:28
VLAI?
Title
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.2 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8015",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:55:34.944756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:55:47.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image\u0027s \u0027Title\u0027 and \u0027Slide link\u0027 fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:28:23.978Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/deba0a29-7fe5-4f94-bee6-9d01e023215e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3328729/shortcodes-ultimate"
        },
        {
          "url": "https://research.cleantalk.org/cve-2025-8015/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-07-22T02:17:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-07-21T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shortcodes Ultimate \u003c= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-8015",
    "datePublished": "2025-07-22T14:43:08.091Z",
    "dateReserved": "2025-07-22T01:57:43.321Z",
    "dateUpdated": "2026-04-08T17:28:23.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7354 (GCVE-0-2025-7354)

Vulnerability from cvelistv5 – Published: 2025-07-21 07:23 – Updated: 2026-04-08 16:57
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.2 (semver)
Create a notification for this product.
Credits
Matthew Rollings
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7354",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-21T11:07:45.711963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-21T11:07:53.742Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthew Rollings"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:57:09.946Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62d32cda-bb6d-4ffa-82b9-f2f6e8d4346f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/members.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/button.php#L408"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/expand.php#L130"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/user.php#L95"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/post.php#L116"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3328729/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-06-24T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-07-08T12:43:43.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-07-20T19:04:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-7354",
    "datePublished": "2025-07-21T07:23:25.369Z",
    "dateReserved": "2025-07-08T12:28:22.432Z",
    "dateUpdated": "2026-04-08T16:57:09.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7369 (GCVE-0-2025-7369)

Vulnerability from cvelistv5 – Published: 2025-07-21 07:23 – Updated: 2026-04-08 16:54
VLAI?
Title
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.
Severity ?
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.2 (semver)
Create a notification for this product.
Credits
Dmitrii Ignatyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-21T17:41:55.597431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-21T17:42:04.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.\r\nIn combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:54:43.933Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/inc/core/generator.php#L339"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3328729/"
        },
        {
          "url": "https://research.cleantalk.org/cve-2025-7369/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-07-07T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-07-08T19:34:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-07-20T19:03:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shortcodes Ultimate \u003c= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-7369",
    "datePublished": "2025-07-21T07:23:25.011Z",
    "dateReserved": "2025-07-08T19:18:27.435Z",
    "dateUpdated": "2026-04-08T16:54:43.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-5567 (GCVE-0-2025-5567)

Vulnerability from cvelistv5 – Published: 2025-07-04 02:22 – Updated: 2026-04-08 17:34
VLAI?
Title
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.0 (semver)
Create a notification for this product.
Credits
Asaf Mozes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5567",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-07T14:38:36.577262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-07T15:01:49.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asaf Mozes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027data-url\u0027 DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:34:36.169Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd67145-5b95-4890-a265-1dd7a029aec6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.0/includes/js/shortcodes/index.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-27T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-06-09T07:22:26.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-07-03T14:14:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shortcodes Ultimate \u003c= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via \u0027data-url\u0027 Attribute"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-5567",
    "datePublished": "2025-07-04T02:22:33.158Z",
    "dateReserved": "2025-06-03T19:20:11.841Z",
    "dateUpdated": "2026-04-08T17:34:36.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-5647 (GCVE-0-2024-5647)

Vulnerability from cvelistv5 – Published: 2025-07-03 09:22 – Updated: 2026-04-08 17:27
VLAI?
Title
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Summary
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
blossomthemes BlossomThemes Social Feed Affected: 0 , ≤ 2.0.5 (semver)
Create a notification for this product.
    sayful Carousel Slider Affected: 0 , ≤ 2.2.14 (semver)
Create a notification for this product.
    divisupreme Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Affected: 0 , ≤ 2.5.52 (semver)
Create a notification for this product.
    robosoft Robo Gallery – Photo & Image Slider Affected: 0 , ≤ 3.2.22 (semver)
Create a notification for this product.
    gutentor Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor Affected: 0 , ≤ 3.4.9 (semver)
Create a notification for this product.
    oceanwp OceanWP Affected: 0 , ≤ 3.6.0 (semver)
Create a notification for this product.
    thehappymonster Happy Addons for Elementor Affected: 0 , ≤ 3.12.2 (semver)
Create a notification for this product.
    badhonrocks Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme Affected: 0 , ≤ 4.0.5 (semver)
Create a notification for this product.
    Elegant Themes Divi Builder Affected: 0 , ≤ 4.27.1 (semver)
Create a notification for this product.
    Elegant Themes Divi Affected: 0 , ≤ 4.27.1 (semver)
Create a notification for this product.
    Elegant Themes Divi Extra Affected: 0 , ≤ 4.27.1 (semver)
Create a notification for this product.
    boldthemes Bold Page Builder Affected: 0 , ≤ 5.1.2 (semver)
Create a notification for this product.
    wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets Affected: 0 , ≤ 6.0.4 (semver)
Create a notification for this product.
    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.4.2 (semver)
Create a notification for this product.
Credits
Craig Smith
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5647",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-03T12:59:42.727059Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-03T13:17:30.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BlossomThemes Social Feed",
          "vendor": "blossomthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Carousel Slider",
          "vendor": "sayful",
          "versions": [
            {
              "lessThanOrEqual": "2.2.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder",
          "vendor": "divisupreme",
          "versions": [
            {
              "lessThanOrEqual": "2.5.52",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Robo Gallery \u2013 Photo \u0026 Image Slider",
          "vendor": "robosoft",
          "versions": [
            {
              "lessThanOrEqual": "3.2.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor",
          "vendor": "gutentor",
          "versions": [
            {
              "lessThanOrEqual": "3.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "OceanWP",
          "vendor": "oceanwp",
          "versions": [
            {
              "lessThanOrEqual": "3.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Happy Addons for Elementor",
          "vendor": "thehappymonster",
          "versions": [
            {
              "lessThanOrEqual": "3.12.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Divi Torque Lite \u2013 Divi Theme, Divi Builder \u0026 Extra Theme",
          "vendor": "badhonrocks",
          "versions": [
            {
              "lessThanOrEqual": "4.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Divi Builder",
          "vendor": "Elegant Themes",
          "versions": [
            {
              "lessThanOrEqual": "4.27.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Divi",
          "vendor": "Elegant Themes",
          "versions": [
            {
              "lessThanOrEqual": "4.27.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Divi Extra",
          "vendor": "Elegant Themes",
          "versions": [
            {
              "lessThanOrEqual": "4.27.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bold Page Builder",
          "vendor": "boldthemes",
          "versions": [
            {
              "lessThanOrEqual": "5.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Essential Addons for Elementor \u2013 Popular Elementor Templates \u0026 Widgets",
          "vendor": "wpdevteam",
          "versions": [
            {
              "lessThanOrEqual": "6.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Craig Smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin\u0027s bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:27:25.153Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/vendor/magnific-popup/magnific-popup.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/assets/front-end/js/lib-view/magnific-popup/jquery.magnific-popup.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements_misc/js/jquery.magnific-popup.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3154460/happy-elementor-addons"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3153781/bold-page-builder"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/robo-gallery/trunk/js/robo_gallery.js#L56"
        },
        {
          "url": "https://www.elegantthemes.com/api/changelog/divi.txt"
        },
        {
          "url": "https://www.elegantthemes.com/api/changelog/extra.txt"
        },
        {
          "url": "https://www.elegantthemes.com/api/changelog/divi-builder.txt"
        },
        {
          "url": "https://themes.trac.wordpress.org/changeset/244604/oceanwp"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3153700/essential-addons-for-elementor-lite"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3184626/addons-for-divi"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3201991/robo-gallery"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3166204/carousel-slider"
        },
        {
          "url": "https://github.com/dimsemenov/Magnific-Popup/releases/tag/1.2.0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-06-05T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-07-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-5647",
    "datePublished": "2025-07-03T09:22:19.308Z",
    "dateReserved": "2024-06-04T21:31:54.009Z",
    "dateUpdated": "2026-04-08T17:27:25.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-0370 (GCVE-0-2025-0370)

Vulnerability from cvelistv5 – Published: 2025-03-04 09:22 – Updated: 2026-04-08 17:32
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.3.3 (semver)
Create a notification for this product.
Credits
Matthew Rollings
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T14:19:22.173400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-04T14:21:01.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthew Rollings"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018src\u2019 parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:32:15.906Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75"
        },
        {
          "url": "https://wordpress.org/plugins/shortcodes-ultimate/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3229060/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-03T20:32:25.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-0370",
    "datePublished": "2025-03-04T09:22:37.463Z",
    "dateReserved": "2025-01-09T22:58:24.363Z",
    "dateUpdated": "2026-04-08T17:32:15.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8500 (GCVE-0-2024-8500)

Vulnerability from cvelistv5 – Published: 2024-10-23 11:04 – Updated: 2026-04-08 17:01
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 7.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.2.2 (semver)
Create a notification for this product.
Credits
Craig Smith
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T13:31:38.588864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-23T13:31:48.533Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Craig Smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 7.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:01:56.371Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/78af6e06-4b4c-4f56-a6f8-f98e8f681976?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/js/shortcodes/index.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3171844/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-22T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-8500",
    "datePublished": "2024-10-23T11:04:27.437Z",
    "dateReserved": "2024-09-05T20:15:39.819Z",
    "dateUpdated": "2026-04-08T17:01:56.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-4821 (GCVE-0-2024-4821)

Vulnerability from cvelistv5 – Published: 2024-06-05 08:33 – Updated: 2026-04-08 17:31
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.1.6 (semver)
Create a notification for this product.
Credits
Richard Telleng
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T13:09:28.968265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T13:09:44.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:55:09.988Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7649da-5358-4fe2-8706-b945bba02c93?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.1.5/includes/shortcodes/lightbox.php#L71"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3096024%40shortcodes-ultimate%2Ftrunk\u0026old=3084162%40shortcodes-ultimate%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Richard Telleng"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:31:24.797Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7649da-5358-4fe2-8706-b945bba02c93?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.1.5/includes/shortcodes/lightbox.php#L71"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3096024%40shortcodes-ultimate%2Ftrunk\u0026old=3084162%40shortcodes-ultimate%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-06-04T20:15:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-4821",
    "datePublished": "2024-06-05T08:33:16.794Z",
    "dateReserved": "2024-05-13T07:15:02.790Z",
    "dateUpdated": "2026-04-08T17:31:24.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-4553 (GCVE-0-2024-4553)

Vulnerability from cvelistv5 – Published: 2024-05-21 09:31 – Updated: 2026-04-08 17:26
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due to insufficient input sanitization and output escaping on user supplied 'color' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.1.5 (semver)
Create a notification for this product.
Credits
wesley
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T14:24:47.785628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:55:32.823Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:47:40.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8db8ed5-ebeb-4102-928f-fe417e429ad2?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.1.4/includes/shortcodes/members.php#L83"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3084162/#file524"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "wesley"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s \u0027su_members\u0027 shortcode in all versions up to, and including, 7.1.5 due to insufficient input sanitization and output escaping on user supplied \u0027color\u0027 attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:26:57.888Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8db8ed5-ebeb-4102-928f-fe417e429ad2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.1.4/includes/shortcodes/members.php#L83"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3084162/#file524"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-05-20T20:36:37.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-4553",
    "datePublished": "2024-05-21T09:31:50.781Z",
    "dateReserved": "2024-05-06T17:02:21.528Z",
    "dateUpdated": "2026-04-08T17:26:57.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-4542 (GCVE-0-2024-4542)

Vulnerability from cvelistv5 – Published: 2024-05-09 20:03 – Updated: 2024-05-16 13:23
VLAI?

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-3548. Reason: This candidate was issued in error. Please use CVE-2024-3548 instead.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-05-16T13:23:54.857Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-3548. Reason: This candidate was issued in error. Please use CVE-2024-3548 instead."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-4542",
    "datePublished": "2024-05-09T20:03:31.506Z",
    "dateRejected": "2024-05-16T13:23:54.857Z",
    "dateReserved": "2024-05-06T12:03:16.747Z",
    "dateUpdated": "2024-05-16T13:23:54.857Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-3550 (GCVE-0-2024-3550)

Vulnerability from cvelistv5 – Published: 2024-05-02 16:52 – Updated: 2026-04-08 17:19
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.1.2 (semver)
Create a notification for this product.
Credits
Matthew Rollings
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3550",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-02T19:23:07.713704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:32:52.126Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:12:07.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf7b0f1b-a6d3-4a96-adaa-0adeb6ea2efd?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/functions-html.php#L51"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L71"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/service.php#L93"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/dailymotion.php#L141"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3069959%40shortcodes-ultimate%2Ftrunk\u0026old=3069892%40shortcodes-ultimate%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthew Rollings"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:28.163Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf7b0f1b-a6d3-4a96-adaa-0adeb6ea2efd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/functions-html.php#L51"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L71"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/service.php#L93"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/dailymotion.php#L141"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3069959%40shortcodes-ultimate%2Ftrunk\u0026old=3069892%40shortcodes-ultimate%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-29T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-3550",
    "datePublished": "2024-05-02T16:52:33.461Z",
    "dateReserved": "2024-04-09T19:45:25.039Z",
    "dateUpdated": "2026-04-08T17:19:28.163Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-3512 (GCVE-0-2024-3512)

Vulnerability from cvelistv5 – Published: 2024-04-09 18:58 – Updated: 2024-04-25 12:57
VLAI?

**DUPLICATE*** Please use CVE-2024-2583 instead.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-04-25T12:57:58.911Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "**DUPLICATE*** Please use CVE-2024-2583 instead."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-3512",
    "datePublished": "2024-04-09T18:58:36.805Z",
    "dateRejected": "2024-04-25T12:57:58.911Z",
    "dateReserved": "2024-04-09T14:04:24.059Z",
    "dateUpdated": "2024-04-25T12:57:58.911Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2024-1808 (GCVE-0-2024-1808)

Vulnerability from cvelistv5 – Published: 2024-02-28 12:50 – Updated: 2026-04-08 17:10
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.0.3 (semver)
Create a notification for this product.
Credits
Craig Smith
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:22.046Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96769a0e-d4a9-4196-8ded-b600046c0943?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3041647/shortcodes-ultimate"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mythemeshop:wp_shortcode:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wp_shortcode",
            "vendor": "mythemeshop",
            "versions": [
              {
                "lessThanOrEqual": "7.0.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T19:30:52.394429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:33:14.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Craig Smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s \u0027su_qrcode\u0027 shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:10:15.156Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96769a0e-d4a9-4196-8ded-b600046c0943?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3041647/shortcodes-ultimate"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-22T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2024-02-27T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-1808",
    "datePublished": "2024-02-28T12:50:50.204Z",
    "dateReserved": "2024-02-22T22:00:45.914Z",
    "dateUpdated": "2026-04-08T17:10:15.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-0792 (GCVE-0-2024-0792)

Vulnerability from cvelistv5 – Published: 2024-02-20 18:56 – Updated: 2026-04-08 16:35
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.0.1 (semver)
Create a notification for this product.
Credits
Craig Smith
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-01T13:43:23.687650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:58:51.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:18:18.607Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8c043c-e347-4dc8-8a72-943a7e6c4394?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/feed.php#L49"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/feed.php#L78"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3026377/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Craig Smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:35:16.536Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8c043c-e347-4dc8-8a72-943a7e6c4394?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/feed.php#L49"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/feed.php#L78"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3026377/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-07T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-0792",
    "datePublished": "2024-02-20T18:56:18.777Z",
    "dateReserved": "2024-01-22T20:50:09.402Z",
    "dateUpdated": "2026-04-08T16:35:16.536Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-1510 (GCVE-0-2024-1510)

Vulnerability from cvelistv5 – Published: 2024-02-20 02:34 – Updated: 2026-04-08 17:31
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplied tags. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.0.2 (semver)
Create a notification for this product.
Credits
Richard Telleng
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T16:53:13.742153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:43.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:40:21.175Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee03d780-076b-4501-a353-376198a4bd7b?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.0.2/includes/shortcodes/tooltip.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3037436/shortcodes-ultimate/trunk/includes/shortcodes/tooltip.php"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Richard Telleng"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplied tags. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:31:42.642Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee03d780-076b-4501-a353-376198a4bd7b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.0.2/includes/shortcodes/tooltip.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3037436/shortcodes-ultimate/trunk/includes/shortcodes/tooltip.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-19T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-1510",
    "datePublished": "2024-02-20T02:34:18.031Z",
    "dateReserved": "2024-02-14T20:42:57.665Z",
    "dateUpdated": "2026-04-08T17:31:42.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-6488 (GCVE-0-2023-6488)

Vulnerability from cvelistv5 – Published: 2023-12-19 01:58 – Updated: 2026-04-08 16:52
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.0.0 (semver)
Create a notification for this product.
Credits
Craig Smith
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.818Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50a89ad1-a3d0-49e3-8d2e-4cb81ac115ba?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/button.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3007660%40shortcodes-ultimate\u0026new=3007660%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Craig Smith"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s \u0027su_button\u0027, \u0027su_members\u0027, and \u0027su_tabs\u0027 shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:52:23.140Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50a89ad1-a3d0-49e3-8d2e-4cb81ac115ba?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/button.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3007660%40shortcodes-ultimate\u0026new=3007660%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-18T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6488",
    "datePublished": "2023-12-19T01:58:59.593Z",
    "dateReserved": "2023-12-04T16:20:20.784Z",
    "dateUpdated": "2026-04-08T16:52:23.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-6225 (GCVE-0-2023-6225)

Vulnerability from cvelistv5 – Published: 2023-11-28 04:31 – Updated: 2026-04-08 16:53
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sanitization and output escaping on user supplied meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 5.13.3 (semver)
Create a notification for this product.
Credits
Francesco Carlucci
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:21:17.992Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/558e36f6-4678-46a2-8154-42770fbb5574?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3000576%40shortcodes-ultimate\u0026new=3000576%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "5.13.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francesco Carlucci"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sanitization and output escaping on user supplied meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:53:30.990Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/558e36f6-4678-46a2-8154-42770fbb5574?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3000576%40shortcodes-ultimate\u0026new=3000576%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-11-27T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6225",
    "datePublished": "2023-11-28T04:31:51.706Z",
    "dateReserved": "2023-11-20T21:47:42.883Z",
    "dateUpdated": "2026-04-08T16:53:30.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-6226 (GCVE-0-2023-6226)

Vulnerability from cvelistv5 – Published: 2023-11-28 04:31 – Updated: 2026-04-08 16:51
VLAI?
Title
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
Summary
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
Vendor Product Version
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 5.13.3 (semver)
Create a notification for this product.
Credits
Francesco Carlucci
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:21:17.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d936a48-b300-4a41-8d28-ba34cb3c5cb7?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3000576%40shortcodes-ultimate\u0026new=3000576%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "5.13.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francesco Carlucci"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys \u0027key\u0027 and \u0027post_id\u0027. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:51:31.785Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d936a48-b300-4a41-8d28-ba34cb3c5cb7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3000576%40shortcodes-ultimate\u0026new=3000576%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-11-27T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate \u003c= 5.13.3 - Insecure Direct Object Reference to Information Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6226",
    "datePublished": "2023-11-28T04:31:51.116Z",
    "dateReserved": "2023-11-20T22:00:59.798Z",
    "dateUpdated": "2026-04-08T16:51:31.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}