WordPress shortcodes-ultimate has 24 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-0370 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in | medium | 6.4 | <7.3.4 | 7.3.4 |
| CVE-2017-18580 | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. | critical | 9.8 | <5.0.1 | 5.0.1 |
| CVE-2023-0890 | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some sho | medium | 6.5 | <5.12.8 | 5.12.8 |
| CVE-2023-0911 | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the | medium | 6.5 | <5.12.8 | 5.12.8 |
| CVE-2021-24525 | The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. N | medium | 5.4 | <5.10.2 | 5.10.2 |
| CVE-2024-3550 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | <7.1.3 | 7.1.3 |
| CVE-2023-6226 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, | medium | 4.3 | <7.0.0 | 7.0.0 |
| CVE-2023-6225 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta sh | medium | 6.4 | <7.0.0 | 7.0.0 |
| CVE-2024-1510 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip | medium | 6.4 | <7.0.3 | 7.0.3 |
| CVE-2023-6488 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button | medium | 5.4 | <=7.0.0 | – |
| CVE-2024-4217 | The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for | medium | 4.7 | <7.1.5 | 7.1.5 |
| CVE-2024-3548 | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it b | medium | 6.1 | <7.1.2 | 7.1.2 |
| CVE-2024-0792 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | <7.0.2 | 7.0.2 |
| CVE-2024-3188 | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes b | medium | 6.3 | <7.1.0 | 7.1.0 |
| CVE-2023-25040 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugi | medium | 6.5 | <5.12.7 | 5.12.7 |
| CVE-2024-2583 | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes befo | medium | 5.4 | <7.0.5 | 7.0.5 |
| CVE-2024-8500 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters | medium | 5.4 | <7.3.0 | 7.3.0 |
| CVE-2022-38086 | Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings chang | medium | 5.4 | <=5.12.0 | – |
| CVE-2024-4821 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbo | medium | 6.4 | <7.1.7 | 7.1.7 |
| CVE-2024-1808 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode | medium | 6.4 | <7.0.4 | 7.0.4 |
| CVE-2024-6766 | The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting th | medium | 5.4 | <7.2.1 | 7.2.1 |
| CVE-2022-41136 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugi | medium | 6.1 | <=5.12.0 | – |
| CVE-2024-4553 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_member | medium | 6.4 | <7.1.6 | 7.1.6 |
| CVE-2025-5567 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM elem | medium | 6.4 | <7.4.1 | 7.4.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked