Extension WordPress
Vulnérabilités Shortcodes Ultimate – Content Elements
Cette page rassemble les failles publiées pour Shortcodes Ultimate – Content Elements, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Shortcodes Ultimate – Content Elements
39 fiches
Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-7.3.3
7.3.4
30/04/2026
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.4.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on…
*-7.4.9
7.5.0
15/04/2026
Shortcodes Ultimate <= 7.4.8 – authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
The WP Shortcodes Plugin – Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping…
*-7.4.8
7.4.9
03/04/2026
Shortcodes Ultimate <= 7.4.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
The WP Shortcodes Plugin – Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the 'src' attribute…
*-7.4.7
7.4.8
03/04/2026
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.4.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the `su_box` shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and…
*-7.4.10
7.5.0
31/03/2026
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.4.5 – Authenticated (Administrator+) Server-Side Request Forgery
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access…
*-7.4.5
7.4.6
23/11/2025
Shortcodes Ultimate <= 7.4.2 – Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization…
*-7.4.2
7.4.3
21/07/2025
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.4.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user…
*-7.4.2
7.4.3
20/07/2025
Shortcodes Ultimate <= 7.4.2 – Cross-Site Request Forgery to Arbitrary Shortcode Execution
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This…
*-7.4.2
7.4.3
20/07/2025
Shortcodes Ultimate <= 7.4.0 – Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping.…
*-7.4.0
7.4.1
03/07/2025
Multiple Plugins <= (Various Versions) – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-7.4.2
7.4.3
02/07/2025
Shortcodes Ultimate <= 7.3.5 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…
*-7.3.5
7.4.0
05/06/2025
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes…
*-7.3.3
7.3.4
03/03/2025
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.2.2 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 7.2.2 due to insufficient input sanitization and output escaping. This makes…
*-7.2.2
7.3.0
22/10/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on…
*-7.1.6
7.1.7
04/06/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.1.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due to insufficient input sanitization and output escaping on…
*-7.1.5
7.1.6
20/05/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user…
*-7.1.2
7.1.3
29/04/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping on…
*-7.1.0
7.1.2
24/04/2024
Shortcodes Ultimate <= 7.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_dailymotion shortcode in all versions, up to and including 7.0.5, due to insufficient input sanitization and output escaping on…
*-7.0.5
7.1.0
05/04/2024
Shortcodes Ultimate <= 7.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'note_color' shortcode in all versions up to, and including, 7.0.4 due to insufficient input sanitization and output escaping on…
*-7.0.4
7.0.5
23/03/2024
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.