Shortcodes Ultimate – Content Elements

24 known CVEs 400K+ active installs

Scan My Site Free
UNKNOWN: 24
Known Vulnerabilities 24
CVE-2026-3885 UNKNOWN EPSS 0.2%
Published 2026-04-16 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to
CVE-2026-2480 UNKNOWN EPSS 0.1%
Published 2026-03-31 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the `su_box` shortcode in all versions up to, and incl
CVE-2025-12800 UNKNOWN EPSS 0.1%
Published 2025-11-23 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. Th
CVE-2025-8015 UNKNOWN EPSS 0.1%
Published 2025-07-22 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and incl
CVE-2025-7369 UNKNOWN EPSS 0.1%
Published 2025-07-21 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce v
CVE-2024-4821 UNKNOWN EPSS 0.3%
Published 2024-06-05 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due
CVE-2024-4821 UNKNOWN EPSS 0.3%
Published 2024-06-05 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due
CVE-2024-4553 UNKNOWN EPSS 0.2%
Published 2024-05-21 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due
CVE-2024-4553 UNKNOWN EPSS 0.2%
Published 2024-05-21 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due
CVE-2024-3550 UNKNOWN EPSS 0.4%
Published 2024-05-02 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insuff
CVE-2024-3550 UNKNOWN EPSS 0.4%
Published 2024-05-02 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insuff
CVE-2024-0792 UNKNOWN EPSS 0.4%
Published 2024-02-29 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insuff
CVE-2024-0792 UNKNOWN EPSS 0.4%
Published 2024-02-29 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insuff
CVE-2024-1808 UNKNOWN EPSS 0.3%
Published 2024-02-28 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due
CVE-2024-1808 UNKNOWN EPSS 0.3%
Published 2024-02-28 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due
CVE-2024-1510 UNKNOWN EPSS 0.4%
Published 2024-02-20 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due t
CVE-2024-1510 UNKNOWN EPSS 0.4%
Published 2024-02-20 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due t
CVE-2023-6488 UNKNOWN EPSS 0.4%
Published 2023-12-19 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up
CVE-2023-6488 UNKNOWN EPSS 0.4%
Published 2023-12-19 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up
CVE-2023-6226 UNKNOWN EPSS 0.4%
Published 2023-11-28 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to miss
CVE-2023-6226 UNKNOWN EPSS 0.4%
Published 2023-11-28 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to miss
CVE-2023-6225 UNKNOWN EPSS 0.4%
Published 2023-11-28 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to,
CVE-2023-6225 UNKNOWN EPSS 0.4%
Published 2023-11-28 · Affected: *
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to,
CVE-2017-2245 UNKNOWN EPSS 0.8%
Published 2017-07-07 · Affected: *
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.

Is Shortcodes Ultimate – Content Elements running on your site?

A free scan detects your plugins and flags any that match these CVEs.

Scan My Site Free