Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Shortcodes Ultimateshortcodes-ultimate-pro
Plugin · shortcodes-ultimate
Shortcodes Ultimate
32 known vulnerabilities on record. Add your version above to see which ones affect you.
Apr 15, 2026WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-3885 · affects up to 7.4.9 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Apr 4, 2026WP Shortcodes Plugin - Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-0738 · affects up to 7.4.8 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Apr 4, 2026WP Shortcodes Plugin - Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-0737 · affects up to 7.4.7 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the 'src' attribute of the su_lightbox shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 31, 2026WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-2480 · affects up to 7.4.10 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the `su_box` shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 23, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Server-Side Request ForgeryCVE-2025-12800 · affects up to 7.4.5 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers
Jul 22, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-8015 · affects up to 7.4.2 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jul 21, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Cross-Site Request ForgeryCVE-2025-7369 · affects up to 7.4.2 · reported by WordfenceMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 21, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-7354 · affects up to 7.4.2 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 3, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-5567 · affects up to 7.4.0 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jun 6, 2025Shortcodes Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49244 · affects up to 7.3.5 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Stored XSS.This issue affects Shortcodes Ultimate: from n/a through <= 7.3.5.
Mar 4, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-0370 · affects up to 7.3.3 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 23, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-8500 · affects up to 7.2.2 · reported by WordfenceMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 7.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-4821 · affects up to 7.1.6 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 21, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-4553 · affects up to 7.1.5 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due to insufficient input sanitization and output escaping on user supplied 'color' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2024Shortcodes Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-25050 · affects up to 5.12.6 · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · fixed in 7.1.2 · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
May 2, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-3550 · affects up to 7.1.2 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · fixed in 7.1.0 · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Apr 13, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not properly escape some of its shortcodes attributes before they are echoed back to usersCVE-2024-2583 · fixed in 7.0.5 · reported by WPScanMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
Feb 28, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-0792 · affects up to 7.0.1 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-1808 · affects up to 7.0.3 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Feb 19, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-1510 · affects up to 7.0.2 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplied tags. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2023WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2023-6488 · affects up to 7.0.0 · reported by WordfenceMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2023WP Shortcodes Plugin — Shortcodes Ultimate: Insecure Direct Object ReferenceCVE-2023-6226 · affects up to 5.13.3 · reported by WordfenceMedium 4.3
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2023WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2023-6225 · affects up to 5.13.3 · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sanitization and output escaping on user supplied meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2023WP Shortcodes Plugin — Shortcodes Ultimate: Server-Side Request Forgery (SSRF)CVE-2023-23800 · affects up to 5.12.6 · reported by PatchstackHigh 7.1
Server-Side Request Forgery (SSRF) vulnerability in Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate.This issue affects WP Shortcodes Plugin — Shortcodes Ultimate: from n/a through 5.12.6.
Mar 30, 2023Auth.CVE-2023-25040 · fixed in 5.12.7 · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPCVE-2022-41136 · affects up to 5.12.0 · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.
Oct 11, 2022Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.CVE-2022-38086 · affects up to 5.12.0 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.
Sep 20, 2021Shortcodes Ultimate: Allows users with Contributor roles to perform stored XSS via shortcode attributesCVE-2021-24525 · fixed in 5.10.2 · reported by WPScanMedium 5.4
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
Aug 22, 2019The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.CVE-2017-18580 · fixed in 5.0.1 · reported by MITRECritical 9.8
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
Jul 7, 2017Shortcodes Ultimate prior to version 4.10.0: Directory traversalCVE-2017-2245 · affects up to 4.9.9 · reported by vultures@jpcert.or.jpMedium 5
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.