getshortcodes vulnerabilities

Products

• shortcodes ultimate 3

Latest getshortcodes CVEs

Newest publication first

1. CVE-2021-24525 The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode...

   Published 2021-09-20

   Medium·CVSS 5.4

   The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that...

2. CVE-2017-18580 The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

   Published 2019-08-22

   Critical·CVSS 9.8

   The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

3. CVE-2017-2245 WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal

   Published 2017-07-07

   Medium·CVSS 5.0

   Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.